I understand that I can index certain parts of the log message, But actually the entire log message gets stores in the _source field. What is I don't want the unidexed parts to get staore in the _source field? Do I have to then disable _source and then enable store for each individual field? Or is there a better alternative?