I have integrated Icinga to my ELK cluster using Icingabeat. Everything is working as expected, but now I don't want to include some of the available fields that are sent to Elasticsearch from Icingabeat.
Reason being I want to use only the fields which are of my use and wants to discard rest of the fields and hence wants to optimize the size of my Icingabeat indexes, which is currently taking GBs for a single day of storage.
I have tried to remove some of the fields (like
fields.yml inside the icingabeat directory, and restarted the icingbeat service. But when i checked the Kibana dashboard then those fields are still there. I don't know whether I am doing the right things or not to achieve what I need.
Please help, as no information I have found on neither Google nor on your forum.