Logstash keep creating field despite the dynamic_mapping being deactivated
You should enforce the mapping at the document type level.
https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-mapping.html
Regardless of the value of this setting, types can still be added explicitly when creating an index or with the PUT mapping API.
So your mapping will look like:
"mappings": { "author": { "dynamic": false, "properties": { "author_name": { "type": "keyword" }, "author_pseudo": { "type": "keyword" }, "author_location": { "type": "text", "fields": { "standard": { "analyzer": "standard", "term_vector": "yes", "type": "text" }, "nlp": { "analyzer": "nlp_analyzer", "term_vector": "yes", "type": "text" } } } } }}
This answer is not exactly what you are requesting, but you can manually remove fields with a logstash filter like this:
filter { mutate { remove_field => ["fieldname"] }}
If your events have a defined list of fields, you could solve your problem this way.