Logstash keep creating field despite the dynamic_mapping being deactivated Logstash keep creating field despite the dynamic_mapping being deactivated elasticsearch elasticsearch

Logstash keep creating field despite the dynamic_mapping being deactivated


You should enforce the mapping at the document type level.

https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-mapping.html

Regardless of the value of this setting, types can still be added explicitly when creating an index or with the PUT mapping API.

So your mapping will look like:

"mappings": {    "author": {        "dynamic": false,        "properties": {            "author_name": {                "type": "keyword"            },            "author_pseudo": {                "type": "keyword"            },            "author_location": {                "type": "text",                "fields": {                    "standard": {                        "analyzer": "standard",                        "term_vector": "yes",                        "type": "text"                    },                    "nlp": {                        "analyzer": "nlp_analyzer",                        "term_vector": "yes",                        "type": "text"                    }                }            }        }    }}


This answer is not exactly what you are requesting, but you can manually remove fields with a logstash filter like this:

filter {  mutate {    remove_field => ["fieldname"]  }}

If your events have a defined list of fields, you could solve your problem this way.