One of my indexes is hitting the "1000 fields" limit pretty regularly and I'd like to calm it down a bit.
I've seen this information but I can't figure out how to set these values.
Oddly enough (to me) when i go to Kibana and look at the "management" / "index patterns" page the index that's suffering reports 615 fields. There are others with many more (> 800).
Do I need to filter out my outputs better (via logstash) and create more separated index patterns? At present I have only a minimal set (all updated daily): filebeat, metricbeat, auditd, collectd and docker.
Collectd is the unhappy lot. It's used to gather JMX data from kafka and cassandra. Perhaps it's nested too deeply?