Unable to limit FileBeat fields

Elastic Stack Beats
1

Good morning, a housekeeping question
We are processing data from a number of API's using Filebeat. The fields we define are working fine but what we have found is that field for all modules are also being added. The index pattern is showing over 5000 fields. We have tried removing them from the fields.yml file.

Can anyone offer a solution on how to remove the fields we don't explicitly define?

Thanks

2

You can consider a bit different setup, using Fleet and Elastic Agent. Both ones install only fields which will be used.

3

Hi, we found the issue. We configured our template file as yml. It needs to be JSON.
Simple fix.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.