Limiting index creation - where to set values?

(ethr bunny) #1

One of my indexes is hitting the "1000 fields" limit pretty regularly and I'd like to calm it down a bit.

I've seen this information but I can't figure out how to set these values.

Oddly enough (to me) when i go to Kibana and look at the "management" / "index patterns" page the index that's suffering reports 615 fields. There are others with many more (> 800).

Do I need to filter out my outputs better (via logstash) and create more separated index patterns? At present I have only a minimal set (all updated daily): filebeat, metricbeat, auditd, collectd and docker.

Collectd is the unhappy lot. It's used to gather JMX data from kafka and cassandra. Perhaps it's nested too deeply?

(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.