Limiting index creation - where to set values?

One of my indexes is hitting the "1000 fields" limit pretty regularly and I'd like to calm it down a bit.

I've seen this information but I can't figure out how to set these values.

Oddly enough (to me) when i go to Kibana and look at the "management" / "index patterns" page the index that's suffering reports 615 fields. There are others with many more (> 800).

Do I need to filter out my outputs better (via logstash) and create more separated index patterns? At present I have only a minimal set (all updated daily): filebeat, metricbeat, auditd, collectd and docker.

Collectd is the unhappy lot. It's used to gather JMX data from kafka and cassandra. Perhaps it's nested too deeply?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.