Kibana prevent loading stored field

[naum (Andrey Naumov)]

Hi All,

I'm trying to work with some huge fields in index (up to 20MB) for some kind of HTTP log - SOAP queries and responses. I do not need to search any data from that fields, but I need to find them by filtering on other fields.
I configured that fields to stored separately (store: true in index mapping) and disabled indexing them (index: false). I exclude this fields from source.

Unfortuantly, on Discover page Kibana sends _mquery request with "stored_fields":["*"], so all this huge fields returned in huge response, slowing down both ElasticSearch and browser.

I failed to find any settings in Kibana management or any recipes in Google or Kibana documentation.

Is there any way to prevent stored fields from loading on Discover page, so that field must be loading only in single document view?

Or may be is there a way to create Saved Search with such settings?

Thanks for your help in advance.

Used product versions:
ES 6.3.2 in docker
kibana 6.3.2 in docker

[Marius_Dragomir]

Hello,

This cannot be done with a saved search, but you may be able to filter out the fields in Management -> Index Patterns -> Source Filters. Can't really recall if stored fields show up there but it's worth a try. Otherwise, I don't see any way to change the way the msearch is done other than changing the code.