logstash - Why are these fields falling through to elasticsearch that are not defined in my index template? -


i disabled dynamic fields in index template:

{   "template": "logstash-mysexylogs*",   "order": 10,   "mappings": {     "_default_": {       "dynamic": false,       "_all": {         "enabled": false       }, 

now looking on logs in kibana see this: enter image description here

these fields not defined in template shouldn't exist @ all, few logs see them shown in screen shot.

why happen , happen few (not logs) , how prevent happening?

these particular fields present in logs if not filtering them out in template im confused why happening scant few , not of them.

you need set dynamic strict.

"mappings": {    "_default_": {      "dynamic": "strict"    }  } 

per documentation, if elasticsearch detects new field, default add mapping. setting "dynamic": false turns setting off, , new fields won't dynamically added.

this post may helpful.


Comments

Popular posts from this blog

c# - Update a combobox from a presenter (MVP) -

How to understand 2 main() functions after using uftrace to profile the C++ program? -

How to put a lock and transaction on table using spring 4 or above using jdbcTemplate and annotations like @Transactional? -