Is it possible to control which field to index in Logstash?

Elastic Stack Logstash
1

Hi,

I'm trying to apply some naming validation to each field that passes through Logstash, to match some predefined naming convention using regex.
Assuming that I can distinguish within Logstash which field is eligible to be indexed or not, is it possible to somehow hint elasticsearch to not index them? without changing the field's name.

Thanks,

2

Typically, if you send a field to elasticsearch then it will get indexed. If you do not want to index the field either remove it from the event, or disable dynamic mapping, and create all your fields using a template in elasticsearch.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.