So we have a very large nested field that contains alot of objects, and on the "discover" page for kibana whenever it appears, the application crashes.
I am aware that source filtering exists for index patterns https://github.com/elastic/kibana/issues/4366 and it works perfectly fine. However is there a way to add in the source filter for every index pattern created from here on out automatically?
Now we can also exclude the field from _source using https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-source-field.html However we lose the ability to debug and see the data when querying in elasticsearch. Which is something we don't want.
I know this is a specific use case, but does anyone have a solution for this?
Unfortunately, there does not appear to be an automated way of doing this out-of-the-box with Kibana.
The semi-automatic solution I can think of is to use the SavedObjects API to modify index patterns programmatically to add the source filtering settings.
That said, I'm interested to know why you might be creating index patterns very often. Is it not possible to use a broader index pattern that can match many of your indices? This way you don't need to create these often.
Well we aren't creating them often enough where this could be a problem. But I was worried about a case where if a user just decided to create a * index pattern(or some index pattern) and on the discovery page the document appeared, it would crash kibana with it being difficult to reproduce.
An extreme edge case.
Right, there is a risk that that could happen. I would recommend leveraging the Spaces & Security features to only give access to creating index patterns to the proper users. That way, only admins can potentially do this + if a bad index pattern does get created, it's isolated to a single space.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.