From 11c0a828c9189fba698ed77d2319b0ef466dabfb Mon Sep 17 00:00:00 2001 From: beats-jenkins Date: Fri, 14 Dec 2018 12:43:18 +0100 Subject: [PATCH 1/2] Ignore non index fields in default_field for Elasticsearch We recently started to use fields with `index: false`. By default all fields are defined as keyword internally which meant these fields were also added to the list of default_fields for Elasticsearch. With this PR these fields are now excluded. --- libbeat/template/processor.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libbeat/template/processor.go b/libbeat/template/processor.go index 32399b5fbb89..e0fbc9e8025c 100644 --- a/libbeat/template/processor.go +++ b/libbeat/template/processor.go @@ -167,7 +167,9 @@ func (p *Processor) keyword(f *common.Field) common.MapStr { fullName = f.Path + "." + f.Name } - defaultFields = append(defaultFields, fullName) + if f.Index == nil || (f.Index != nil && *f.Index) { + defaultFields = append(defaultFields, fullName) + } property["type"] = "keyword" @@ -201,7 +203,9 @@ func (p *Processor) text(f *common.Field) common.MapStr { fullName = f.Path + "." + f.Name } - defaultFields = append(defaultFields, fullName) + if f.Index == nil || (f.Index != nil && *f.Index) { + defaultFields = append(defaultFields, fullName) + } properties["type"] = "text" From 3136f40c59d72328945aad5ccfc55c658e864ac4 Mon Sep 17 00:00:00 2001 From: beats-jenkins Date: Fri, 14 Dec 2018 12:49:31 +0100 Subject: [PATCH 2/2] add changeog --- CHANGELOG.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index c103a4cb2c02..92482af29baa 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -52,6 +52,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha1...master[Check the HEAD d - Refresh host metadata in add_host_metadata. {pull}9359[9359] - When collecting swap metrics for beats telemetry or system metricbeat module handle cases of free swap being bigger than total swap by assuming no swap is being used. {issue}6271[6271] {pull}9383[9383] - Adding logging traces at debug level when the pipeline client receives the following events: onFilteredOut, onDroppedOnPublish. {pull}9016[9016] +- Ignore non index fields in default_field for Elasticsearch. {pull}9549[9549] *Auditbeat*