Understand "enable: false" mapping setting

Elastic Stack Elasticsearch
1

Hello all !

I'm trying to understand "enable: false" mapping setting

I don't want to index a specific field : syslog_timestamp

To achieve this, I mapped this field with "enabled: false" like this (extract of Index management -> index -> Mappings in Kibana) :

{
  "mappings": {
    "_doc": {
      "dynamic": "false",
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "syslog_timestamp": {
          "type": "object",
          "enabled": false
        },
        "type": {
          "type": "keyword"
        }
      }
    }
  }
}

When looking at my log in Kibana, I can see this field :

enabled
enabled973×760 21.3 KB

Question : Is it normal I still can see this field as he is not enabled ?

Documentation says that :

The JSON can still be retrieved from the _source field, but it is not searchable or stored in any other way

For me, "not stored" means field can't be retrived in Kibana

Thanks for your help !

2

What happens if you refresh the mapping there in Kibana, does that warning go away?

3

No...I refreshed and still there. I deleted index pattern and re created it but still there too
In index pattern, I can't see the field but I can see it in Discover

4

I may be wrong, but I guess Kibana is parsing the _source and showing it. And even after refreshing it shows that warning as it has no mapping for it.

So it's stored in _source, but not mapped and not searchable.

5

Yes indeed he is not seachable I tested it.

I guees there is no way to tell to Kibana to not show fields which are not enbabled ?

6

I am not sure. It might be worth creating a new topic in #elastic-stack:kibana and asking the team there.

7

Ok I will do that. Thank you @warkolm ! :slight_smile: