I've taken on an environment and am getting up to speed on the ELK stack. In some of my old indices are a lot of randomly named fields where a URI or some HTTP content has been passed in and not correctly parsed into fields.
I've created a new EL2.1 cluster and would like to prevent this in future. I've tried setting "dynamic" : "strict" and explicity defined the fields and mappings I want to see within a template but it appears that when passing info over from Logstash, when it attempts to create additional field and hits this setting, the document is not loaded into EL.
Can anybody advise if there is a way that I can get documents to load all permitted fields and ignore those not defined?