https://www.elastic.co/guide/en/elasticsearch/reference/current/enabled.html
0. Delete your index pattern
1. Get default template
If you are using logstash, then you can find default template from kibana Dev API
GET _template/logstash
2. Add index disable setting
If you don't want to use "foo" field for index, you can tell ES "do not indexing this field"
copy default template and add "foo": {"enabled": false} this setting on "properties" of default template
"properties": {
"foo": {"enabled": false}
}
3. put new settings
PUT _template/logstash
{
... changed whole new template ...
}
* If you want to remove .keyword things, setting "string_fields" under mappings._default_.dynamic_templates
(WARN: keyward is for keyword search of target field. if you want keyword search for specific field, you can setting it manually in template.json)
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false
}
}
* Other way to using template.json file instead of changing _template/logstash
1. make template.json from GET _template/logstash
2. add template.json to logstash.conf
3. restart logstash
elasticsearch {
hosts => ["http://domain:80"]
template => "/etc/logstash/template.json"
}
template.json full version example)
{
"order": 0,
"version": 60001,
"index_patterns": [
"logstash-*"
],
"settings": {
"index": {
"refresh_interval": "5s"
}
},
"mappings": {
"_default_": {
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false
}
}
}
],
"properties": {
"@version": {
"enabled": false
},
"offset": {
"enabled": false
},
"tags": {
"enabled": false
}
}
}
},
"aliases": {}
}