ElasticSearch, How to reduce index for performance.

https://www.elastic.co/guide/en/elasticsearch/reference/current/enabled.html

0. Delete your index pattern

1. Get default template

If you are using logstash, then you can find default template from kibana Dev API

GET _template/logstash

2. Add index disable setting

If you don't want to use "foo" field for index, you can tell ES "do not indexing this field"

copy default template and add "foo": {"enabled": false} this setting on "properties" of default template

"properties": {

  "foo": {"enabled": false}

}

3. put new settings

PUT _template/logstash

{

  ... changed whole new template ...

}

* If you want to remove .keyword things, setting "string_fields" under mappings._default_.dynamic_templates

(WARN: keyward is for keyword search of target field. if you want keyword search for specific field, you can setting it manually in template.json)

"string_fields": {
  "match": "*",
  "match_mapping_type": "string",
  "mapping": {
    "type": "text",
    "norms": false
  }
}

* Other way to using template.json file instead of changing _template/logstash

1. make template.json from GET _template/logstash

2. add template.json to logstash.conf

3. restart logstash

elasticsearch {
  hosts => ["http://domain:80"]
  template => "/etc/logstash/template.json"
}

template.json full version example)

{
  "order": 0,
  "version": 60001,
  "index_patterns": [
    "logstash-*"
  ],
  "settings": {
    "index": {
      "refresh_interval": "5s"
    }
  },
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "message_field": {
            "path_match": "message",
            "match_mapping_type": "string",
            "mapping": {
              "type": "text",
              "norms": false
            }
          }
        },
        {
          "string_fields": {
            "match": "*",
            "match_mapping_type": "string",
            "mapping": {
              "type": "text",
              "norms": false
            }
          }
        }
      ],
      "properties": {
        "@version": {
          "enabled": false
        },
        "offset": {
          "enabled": false
        },
        "tags": {
          "enabled": false
        }
      }
    }
  },
  "aliases": {}
}