Too many field in metricbeat

[elasticforme (Sachin)]

When I start the metricbeat it loads about 3000 field.

I know it is loading default template. even when I have only one module.d/system.yml file.

how do I only load system template?

[tactics]

I have just posted about this too:
https://discuss.elastic.co/t/filebeat-index-template-from-modules/242660

Not sure if this creates an issue or not but it would be really nice to know for sure. Got to be a way of only including the used fields from any given module in the index template.

[elasticforme (Sachin)]

thanks
Lets see if someone has gone through this and knows how to do this.
I am still testing to figure out.

I have gone through kibana UI and modify default metricbeat template to trim down #field to 500 but still don't know how to do this cleanly

[tactics]

@elasticforme - I have tried editing the fields.yml to remove the modules that aren't needed, this has reduced the number of fields in my index template. Still checking to see if there are any issues with this but this might work for you as well.

Filebeat Index Template from Modules

Hi, Not sure if I am overcomplicating things and bothering unnecessarily... I have finally got apache logs importing nicely using Filebeat and the Apache module. I am simply using the fields.yml and therefore the index template is massive... Is there any way to only include the fields that are used in the module or maybe use the Index to generate fields and mappings that are being used? Maybe I don't actually need to worry about this as the field definitions and mappings don't take up space…

[elasticforme (Sachin)]

Anyone's input idea welcome

[elasticforme (Sachin)]

giving last bump. I can't believe no one has face this issue

[elasticforme (Sachin)]

does anyone has done anything to fix this.

I just started filebeat to monitor only logstash but it loaded everything from template.

how do I only load what I need. where is this default template?

[di.lu (Di)]

I edited the fields.yml myself to only look at certain fields I need. With regards to the default template, it can be exported by "metricbeat export template" command, according to this doc: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html

[elasticforme (Sachin)]

Thank you I did update fields.yml file finally. it was 30,000+ line trim down to 2000 line to get me only systems, elasticsearch and kibana matric.

hopefully elastic can develop something which loads only module that I user need. I have not found proper command for it. this is long and ugly process.