Remove kibana exported fields from "Add Filter"

[gizem]

I use kibana 7.0.1 and filebeat 7.0.1. There is always "exported fields" in my indexes even if they are empty. And these exported fields are always shown in "Add Filter" part. Why exported fields are always in my indexes? Is there any way to remove these fields or just unvisible in "Add Filter" part?

Thank you.

[joshdover]

Unfortunately, there is no way to do this from within Kibana.

What you will need to do is to modify the fields that Metricbeat uses to create the index template and mappings for metricbeat indices, and then reload the index pattern in Kibana.

To do this, you will need to modify the default fields.yml file that is shipped with Metricbeat. You can then configure metricbeat to use this file instead when creating the index template:

setup.template.fields: "path/to/fields.yml"

You can then follow the instructions from the Metricbeat documentation to overwrite the existing template.

Keep in mind, this will only apply to new metricbeat indices that are created, so you may want to pick a new naming scheme for these indices, reindex your old indices, or delete them. Once all of this is done you can either create a new index pattern in Kibana for the new naming scheme or reload the existing one.

[gizem]

Thank you @joshdover.
It probably works for me. But what if i dont change the naming scheme, is it does not work? is deleting old indices which starts with scheme name enough?

[joshdover]

Yes deleting the old indices before you recreate the index pattern should work fine.