Removing fields from existing pattern


(Dawid) #1

Hi.

I'm pretty new in Kibana and Elastic. Of course I'm reading the docs but unfortunatelly can't find answers on a few question.

I'm administrating existing cluster and try to optimized it and keep it straight but for now my biggest problem is disk space - data stored by logstash are 6x times bigger than original logs.

I know that all metas incresed size so I figured out that I will remove a few fields from _source but I can't do this.

From kibana we go to settings->indices and got one index contains 278 fields. I really don't need so much fileds but I cant delete them. Is there any chance to removes unnecesary _source fields?

And I know that it is kibana topic but maybe you can help me with logstash data size? I found that you can change compression but I don't know how. I can't find index pattern on server to add index.codec and set it to best_compression. We use kopf plugin which have some additional options but it can't change index.codec too.

Thanks for your attention :slight_smile:

PS. Sorry if I create topic in bad categories


(Mark Walkom) #2

The only way to do this would be to reindex - essentially delete the data and then send it back with the reduced fields.


(system) #3