I am using logstash 1.3 to inject data into elasticsearch 5.1, it works fine and extract several fields from the messages
when I added the following line to the index template setting , and it stopped extracting field values,
"_source" : {"enabled" : false },
It is still extracting field values, but as you are not storing the source, there is nothing for Kibana to show. You should still be able to build visualisations though even if you can not inspect the data.
Thank you very much!
I would recommend having _source enabled though, as it makes it easier to view data and reindex it if necessary.
Yes, you are right. If it is possible, I want to choose some fields to be stored _source. That would save some hard disk space for us.
As described in this blog post, you can save a lot of space by optimise mappings and index settings, without having to sacrifice functionality by disabling _source.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
