_size pluging not creating field 6.2.4

Elastic Stack Elasticsearch
1

Hey everyone,
I'm trying to get the _size plugin to work and am kind of stuck here. I installed it on every node in my cluster via a rolling restart. I think added the _size enabled to my mapping template and rolled over the index. Yet when I search on the new index there is no _size field. Any directions would be helpful.

Beginning of Mapping:

{
  "x-2018.05.16-1": {
    "mappings": {
      "doc": {
        "_size": {
          "enabled": true
        },
        "properties": {
          "@timestamp": {
            "type": "date"
          },

Query against the index:

  {
    "_index": "x-2018.05.16-1",
    "_type": "doc",
    "_id": "rOuhaWMBQY84VxJFIVU_",
    "_score": 1,
    "_source": {
      "prospector": {},
      "pid": "10163",
      "source": "/var/log/xt/api-gateway.log",
      "program": "api-gateway",
      "message": "gateway.plugin.httpproxy.transport  elapsed=22.060988ms",
      "error": "x Go Pipeline",
      "tags": [
        "Engineering-api-gateway"
      ],
      "hostname": "ip-10-10-41-38",
      "@timestamp": "2018-05-16T15:45:16.540Z",
      "beat": {
        "hostname": "ip-10-10-41-38"
      },
      "Level": "INFO",
      "fields": {
        "app_name": "api-gateway",
        "class": "x"
      }
    }
  }
2

If you expect to see it you're wrong IMO.
Elasticsearch does not modify the _source.

But you can probably query it or if it's stored ask to get back this field explicitly instead of (or in addition to) default _source field.

3

Isn't that the point of this ES plugin though? And shouldn't I see it as a field when queried? Maybe this page is a bit misleading then? https://www.elastic.co/guide/en/elasticsearch/plugins/current/mapper-size.html

4

Ahh ok interesting, so this can only be queried as a scripted field. Any thoughts on adding this field to a document and if this is a bad idea and destined to cause a performance hit on high volume clusters?

5

I think this page is clear though: https://www.elastic.co/guide/en/elasticsearch/plugins/current/mapper-size-usage.html

6

Any idea on if this can be a scripted field in Kibana? trying things like doc['_size'].value but no luck

7

I think you can do it in index management.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.