-
Notifications
You must be signed in to change notification settings - Fork 8.5k
Description
Describe the feature:
It is considered good practice to use the Elastic Common Schema (ECS) for mapping. If you do not know all of the fields which may ever be used, you could just import the entire mapping:
https://github.com/elastic/ecs/blob/master/generated/elasticsearch/7/template.json
This however results in Kibana having LOTS of unused fields listed in any drop-downs where the user should select the field from - the majority of the fields available in the mapping do not have a single document with this field.
Would it be possible in the index pattern interface to have a flag which if enabled (for creating or refreshing an index) would only create field definitions for those fields where there is a mapping defined and at least one document exists with this field in the matching indices. In this way the mapping could be complete for all eventualities, but also the index pattern and resulting available fields in drop-down and auto-complete menues would only show the fields for which some data exists.