# How to automatically enable the \_size field with Beats? **URL:** \ **Category:** Beats\ **Tags:** filebeat, heartbeat\ **Created:** [December 7, 2023, 3:08pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820 "2023-12-07T15:08:39Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Post date:** [December 7, 2023, 3:08pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/1 "2023-12-07T15:08:39Z")
Hey there, I was trying to use the `mapper-size` plugin. Following the official documentation, I saw that I have to enable into index's mapping the `_size` field. My doubt is, how can I do it automatically using Beats? When Heartbeat tries to connect for the first time to Elasticsearch cluster, will upload the `heartbeat-*` data stream. It has not the `_size` enabled. ---
**Author:** ![jkambic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkambic/32/53306_2.png) [@jkambic](https://discuss.elastic.co/u/jkambic)\ **Post date:** [December 8, 2023, 8:36pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/2 "2023-12-08T20:36:35Z")
Hi, it would help me a bit to know more about your use case. Are you using Heartbeat on its own via the released binary? Also which version of the Stack and Heartbeat are you using? ---
**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Post date:** [December 8, 2023, 10:40pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/3 "2023-12-08T22:40:02Z")
Currently I am using the ELK 8.8.X version. I am using Heartbeat for Uptime purpose with official binary ---
**Author:** ![jkambic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkambic/32/53306_2.png) [@jkambic](https://discuss.elastic.co/u/jkambic)\ **Post date:** [December 11, 2023, 9:49pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/4 "2023-12-11T21:49:28Z")
To be honest, I have never used this plugin before but I think you will need some custom mapping to get it to work. ---
**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Post date:** [December 12, 2023, 6:50am UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/5 "2023-12-12T06:50:31Z")
For sure, i have to use a mapping with \_size enabled. Kibana gives the chance to enable it, when i use it to modify index template. I was trying to understand if i can enable \_size metadata by default ---
**Author:** ![emilioalvap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emilioalvap/32/99310_2.png) [@emilioalvap](https://discuss.elastic.co/u/emilioalvap)\ **Post date:** [December 12, 2023, 5:19pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/6 "2023-12-12T17:19:04Z")
Hi @rschirin, If you want HB to automatically create the required mappings, you'll need to follow the guide [here](https://www.elastic.co/guide/en/beats/heartbeat/current/heartbeat-template.html#heartbeat-template). Any data that is already contained on the indeces will _most likely_ need to be re-indexed. As Justin mentioned, it is not a use case we come across very often, so ymmv. ---
**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Post date:** [December 13, 2023, 2:46pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/7 "2023-12-13T14:46:10Z")
Hi @emilioalvap, following that guide (that is to import index template at the Heartbeat boot) I see only one critical point: if I update the HB version (8.8, 8.9, 8.10 and so on), I will not track any template additional fields. isn't it? Anytime I will update the HB version I will have to check the index template and eventually manually update ---
**Author:** ![emilioalvap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emilioalvap/32/99310_2.png) [@emilioalvap](https://discuss.elastic.co/u/emilioalvap)\ **Post date:** [December 13, 2023, 3:16pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/8 "2023-12-13T15:16:23Z")
Hi @rschirin, Yes, it seems that would be the case. The process can probably be automated but it requires adjusting for each stack version. ---
**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Post date:** [December 13, 2023, 3:20pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/9 "2023-12-13T15:20:10Z")
just an idea. is it not possible to think about this case only for the metadata fields? Something like: `setup.template.metadata: true` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 10, 2024, 5:20pm UTC](https://discuss.elastic.co/t/how-to-automatically-enable-the-size-field-with-beats/348820/10 "2024-01-10T17:20:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.