# Ingest pipeline for APM traces not working **URL:** \ **Category:** APM\ **Tags:** elastic-stack-monitoring, java\ **Created:** [October 5, 2025, 10:12am UTC](https://discuss.elastic.co/t/ingest-pipeline-for-apm-traces-not-working/382419 "2025-10-05T10:12:58Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![SamehSaeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samehsaeed/32/145262_2.png) [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Post date:** [October 5, 2025, 10:12am UTC](https://discuss.elastic.co/t/ingest-pipeline-for-apm-traces-not-working/382419/1 "2025-10-05T10:12:58Z")
**Kibana version** :9.0.3 **Elasticsearch version** :9.0.3 **APM Server version** :9.0.3 **APM Agent language and version** : Java, 1.49.0 **Browser version** : Chrome 140.0.7339.81 **Original install method (e.g. download page, yum, deb, from source, etc.) and version**: Windows zip file **Fresh install or upgraded from other version?** Fresh install **Is there anything special in your setup?** Standalone APM server, outputs to Elasticsearch **Description of the problem including expected versus actual behavior. Please include screenshots (if relevant)**: I’m trying to drop some fields (using ingest pipeline) from the transaction of APM to reduce the index size (traces-apm) **Steps to reproduce** : 1.Create component template “traces-apm@custom” : Settings : `{ "index": { "number_of_replicas": "0", "default_pipeline": "traces-apm-drop-text" } }` 2.Create ingest pipeline “[traces-apm@custom](https://10.21.144.94:5601/app/management/ingest/ingest_pipelines?queryText=custom&pipeline=traces-apm%40custom)” ==\> ```auto PUT _ingest/pipeline/traces-apm@custom { "description": "Drop .text fields in traces", "processors": [ { "remove": { "field": [ "service.name.text", "agent.name.text", "host.name.text", "service.node.name.text" ], "ignore_missing": true } } ] ``` 1. push any request to APM server and still observe the “to be dropped” fields : ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/2/62ff5675d64d84674fd7e138c28ed510133f00fb.png) **Errors in browser console (if relevant)**: none **Provide logs and/or server output (if relevant)**:none ---
**Author:** ![SamehSaeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samehsaeed/32/145262_2.png) [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Post date:** [October 5, 2025, 1:52pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-apm-traces-not-working/382419/2 "2025-10-05T13:52:27Z")
Found something that might be useful, fields that have “dots” in their names means they are nested objects, need dot\_expander to work, like this : ```auto PUT _ingest/pipeline/traces-apm@custom { "description": "Drop .text fields in traces", "processors": [ // First, expand the dotted field names into proper nested objects { "dot_expander": { "field": "service.name.text" } }, { "dot_expander": { "field": "agent.name.text" } }, { "dot_expander": { "field": "host.name.text" } }, { "dot_expander": { "field": "service.node.name.text" } }, { "dot_expander": { "field": "process.title.text" } }, // Then, remove the now-nested fields { "remove": { "field": [ "service.name.text", "agent.name.text", "host.name.text", "service.node.name.text", "process.title.text" ], "ignore_missing": true } } ] } ``` But still there is a problem, if i use simulate for the above pipeline it works : input ==\> ```auto PUT _ingest/pipeline/traces-apm@custom { "description": "Drop .text fields in traces", "processors": [ // First, expand the dotted field names into proper nested objects { "dot_expander": { "field": "service.name.text" } }, { "dot_expander": { "field": "agent.name.text" } }, { "dot_expander": { "field": "host.name.text" } }, { "dot_expander": { "field": "service.node.name.text" } }, { "dot_expander": { "field": "process.title.text" } }, // Then, remove the now-nested fields { "remove": { "field": [ "service.name.text", "agent.name.text", "host.name.text", "service.node.name.text", "process.title.text" ], "ignore_missing": true } } ] } ``` Output ==\> ```auto { "docs": [ { "doc": { "_index": "_index", "_version": "-3", "_id": "_id", "_source": { "service.node.name": "my-service", "agent": { "name": {} }, "service.name": "my-service", "service": { "name": {}, "node": { "name": {} } } }, "_ingest": { "timestamp": "2025-10-05T13:46:33.9303944Z" } } } ] } ``` But it still doesn’t work in APM traces. It worked for non-text fields like “service.node.name” and “service.name” but it broke the APM traces tab so I deleted it. Is there any way to remove these text fields? APM indices are too large. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 5, 2025, 2:59pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-apm-traces-not-working/382419/3 "2025-10-05T14:59:02Z")
Hi @SamehSaeed Good research. However, there is a different reason why this is happening. The `.text` is defined in the mapping which happens when the document is written which is after the ingest pipeline. So the approach you're taking will never actually work. If you do not want the `.text` you need to change the mapping by applying an `@custom` template and redefine the mapping So you would define the new mappings here `traces-apm@custom` component template I would caution against this unless you're an expert because that could have other ramifications in the overall app experience I guess I would go back to. What are you actually trying to solve? I'm away from keyboard at the moment but I didn't want you to spend too much more tine to solve it with the approach you're trying... It won't work ---
**Author:** ![SamehSaeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samehsaeed/32/145262_2.png) [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Post date:** [October 5, 2025, 5:44pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-apm-traces-not-working/382419/4 "2025-10-05T17:44:21Z")
Hello Stephen, Thanks alot for your reply, this indeed saved much time. My actual goal is to minimize the size of the index as much as I can. Our management requested a retention of 90 days for apm traces while we can only provide 5 atm. 😅 Our goal is to shrink down the 70gb daily index to 20-25 but I don't really have a clear vision of how to do it. So i just thought maybe deleting duplicate fields or text fields would help. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 6, 2025, 2:17pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-apm-traces-not-working/382419/5 "2025-10-06T14:17:14Z")
> [@SamehSaeed](#): > > 70gb daily index to 20-25 You are going to be hard-pressed to do that. You can redefine the mappings and/or drop whole fields ... there should be a number of fields you can drop there are a lot under host etc that you can probably drop. Also, make sure `best_compression` is enabled if it is not, you can put that in your custom component template.