How to automatically enable the _size field with Beats?

Hey there, I was trying to use the mapper-size plugin. Following the official documentation, I saw that I have to enable into index's mapping the _size field.
My doubt is, how can I do it automatically using Beats? When Heartbeat tries to connect for the first time to Elasticsearch cluster, will upload the heartbeat-* data stream. It has not the _size enabled.

Hi, it would help me a bit to know more about your use case. Are you using Heartbeat on its own via the released binary? Also which version of the Stack and Heartbeat are you using?

Currently I am using the ELK 8.8.X version. I am using Heartbeat for Uptime purpose with official binary

To be honest, I have never used this plugin before but I think you will need some custom mapping to get it to work.

For sure, i have to use a mapping with _size enabled. Kibana gives the chance to enable it, when i use it to modify index template. I was trying to understand if i can enable _size metadata by default

Hi @rschirin,

If you want HB to automatically create the required mappings, you'll need to follow the guide here.

Any data that is already contained on the indeces will most likely need to be re-indexed. As Justin mentioned, it is not a use case we come across very often, so ymmv.

Hi @emilioalvap,
following that guide (that is to import index template at the Heartbeat boot) I see only one critical point: if I update the HB version (8.8, 8.9, 8.10 and so on), I will not track any template additional fields. isn't it?
Anytime I will update the HB version I will have to check the index template and eventually manually update

Hi @rschirin,

Yes, it seems that would be the case. The process can probably be automated but it requires adjusting for each stack version.

just an idea. is it not possible to think about this case only for the metadata fields?
Something like:

setup.template.metadata: true

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.