@Travis posted a new topic, subject "Understand "enable: false" mapping setting". It read:

   Hello all !
    
    I'm trying to understand "enable: false" mapping setting
    
    I don't want to index a specific field : **syslog_timestamp**
    
    To achieve this, I mapped this field with "enabled: false" like this (extract of Index management -> index -> Mappings in Kibana) :
    [code] 
        {
          "mappings": {
            "_doc": {
              "dynamic": "false",
              "properties": {
                "@timestamp": {
                  "type": "date"
                },
                "syslog_timestamp": {
                  "type": "object",
                  "enabled": false
                },
                "type": {
                  "type": "keyword"
                }
              }
            }
          }
        }
        
    [/code]
    
    When looking at my log in Kibana, I can see this field :
    
    enabled973×760 21.3 KB
    
    **Question** : Is it normal I still can see this field as he is not enabled ?
    
    Documentation says that :
    
    > The JSON can still be retrieved from the  `_source` field, but it is not searchable or stored in any other way
    
    For me, "not stored" means field can't be retrived in Kibana
    
    Thanks for your help !

After which, @warkolm (Mark Walkom) added

    What happens if you refresh the mapping there in Kibana, does that warning go away?

So @Travis replied

    No...I refreshed and still there. I deleted index pattern and re created it but still there too  
    In index pattern, I can't see the field but I can see it in Discover

So @warkolm (Mark Walkom) replied

    I may be wrong, but I guess Kibana is parsing the `_source` and showing it. And even after refreshing it shows that warning as it has no mapping for it.
    
    So it's stored in `_source`, but not mapped and not searchable.

After which, @Travis added

    Yes indeed he is not seachable I tested it.
    
    I guees there is no way to tell to Kibana to not show fields which are not enbabled ?

@warkolm (Mark Walkom) replied

    I am not sure. It might be worth creating a new topic in #elastic-stack:kibana and asking the team there.

So @Travis replied

    Ok I will do that. Thank you @warkolm !

So @system (system) replied

    This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.


{'source': 'discourse', 'url': 'https://discuss.elastic.co/t/understand-enable-false-mapping-setting/270084', 'title': 'Understand "enable: false" mapping setting', 'views': 356, 'has_accepted_answer': True, 'word_count': 307, 'like_count': 1, 'reply_count': 3, 'participant_count': 2, 'posts': 8, 'tags': '', 'author': '@Travis', 'participants': '@Travis, @warkolm (Mark Walkom), @system (system)', 'image_url': ['https://global.discourse-cdn.com/elastic/original/3X/4/9/49ffae577aab41a927bb19d7e8fe8005ed09d017.png'], 'created_at': '2021-04-14T07:46:02.368Z', 'last_posted_at': '2021-05-12T08:35:11.123Z'}