I am using Elasticsearch for log analysis, and I am trying to increase performance, reduce storage as much as possible. I have turned off dynamic mapping, added the not_analyzed strings explicitly where needed, as well as stating in the default mapping that strings are not_analyzed. That part is working great.
With the geoip plugin though, it still adds the raw field equivalents of the geoip string fields. These respect my default mapping and are not analyzed, but then they are redundant with the main field. I also cannot mutate remove_field those raw fields like [geoip][region_name][raw]. How can I get rid of these raw fields while keeping their regular partners?
Or, ideally, can I declare which geoip fields I want, instead of mutate deleting some of them? That seems like wasteful processing.