We had enabled modules in filebeat by accident and have since disabled them. I cannot figure out how to remove the module fields from the index. I tried creating a new index from the days after the modules in filebeat were disabled. I tried using exclude in the management dashboard, but they still show up in visualizations.
hi @Leif, have you tried reindexing those problematic indices (https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html) , this is an option to removing the module fields?
Regarding the visualizations, are these custom visualizations or the default filebeat ones?
Yes I reindexed the existing ones, but new ones still have them. The visualizations are the basic ones from filebeat I believe. I'm just going to visualize and selecting the index.
Hi,
I think you should post screenshots of your issue so we understand what you mean. The descriptions you make are vague. I think what your describing is normal. If your using filebeat with the default config and you do not completely customize your index template manually, you see ALL the POSSIBLE fields of filebeat. Even if your not actually using them. Thats how it works unless you learn more about index templates and customize them by editing them.
I think you see too many fields in field lists...but there is no data in those fields?
The visualizations are the basic ones from filebeat I believe. I'm just going to visualize and selecting the index.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.