a question about metricbeat template and sparsity :
My understanding is that when setting up the metricbeat template in ElasticSearch via the following command :
metricbeat setup --template
The whole template is loaded into ElasticSearch according to what is described into fields.yml, regardless of what modules are enabled. That is to say, for instance, that, if I only want to use the system module, every document in elasticsearch will have a total of approximately 2500 fields with a vas majority of those being empty.
Although I am aware that sparsity handling has been greatly optimized and improved since the introduction of Lucene 7, I was wondering if there was something I was missing when it comes to setting up the template only for the enabled modules or if this was meant to be used this way, with the whole template loaded.
In a nutshell :
Is it a problem (considering the incuced sparsity) to have the whole, huge metricbeat template loaded in ElasticSearch or is it normal behavior ?
If not, is there a way (other than manually editing the fields.yml) to choose which part of the template to push to ElasticSearch, according to the enabled modules ?
Thanks a lot