In the elasticsearch documentation, it is mentioned that you can disable the source field to reduce disk usage on ingested data. It does claim there are many drawbacks when doing so, however what I observed did not seem covered in those docs.
After we disabled the _source field ALL fields stopped being indexed and visible in kibana. the documents were there just totally empty. Is this expected, or am I perhaps doing something wrong? Our index template looks like this:
{
“order”: 2,
“index_patterns”: [
“my_index*”
],
“settings”: {
“index”: {
“codec”: “best_compression”,
“number_of_shards”: “2”,
“default_pipeline”: “default”,
“opendistro”: {
“index_state_management”: {
“policy_id”: “default”
}
}
}
},
“mappings”: {
“_source”: {
“enabled”: false
}
},
“aliases”: {}
}