Problem after disable _source field

[sharon.c]

I am using logstash 1.3 to inject data into elasticsearch 5.1, it works fine and extract several fields from the messages

when I added the following line to the index template setting , and it stopped extracting field values,
"_source" : {"enabled" : false },

[Christian_Dahlqvist]

It is still extracting field values, but as you are not storing the source, there is nothing for Kibana to show. You should still be able to build visualisations though even if you can not inspect the data.

[sharon.c]

Thank you very much!

[Christian_Dahlqvist]

I would recommend having _source enabled though, as it makes it easier to view data and reindex it if necessary.

[sharon.c]

Yes, you are right. If it is possible, I want to choose some fields to be stored _source. That would save some hard disk space for us.

[Christian_Dahlqvist]

As described in this blog post, you can save a lot of space by optimise mappings and index settings, without having to sacrifice functionality by disabling _source.