logstash - Why are these fields falling through to elasticsearch that are not defined in my index template? -
i disabled dynamic fields in index template:
{ "template": "logstash-mysexylogs*", "order": 10, "mappings": { "_default_": { "dynamic": false, "_all": { "enabled": false }, now looking on logs in kibana see this: 
these fields not defined in template shouldn't exist @ all, few logs see them shown in screen shot.
why happen , happen few (not logs) , how prevent happening?
these particular fields present in logs if not filtering them out in template im confused why happening scant few , not of them.
you need set dynamic strict.
"mappings": { "_default_": { "dynamic": "strict" } } per documentation, if elasticsearch detects new field, default add mapping. setting "dynamic": false turns setting off, , new fields won't dynamically added.
this post may helpful.
Comments
Post a Comment