Kibana logging mapping explosion #45255
Description
We're seeing a mappings explosion where if Kibana log entries include objects in the meta a mapping field is created for each field recursively leading to as many an 2400 fields. meta is intended to include additional context that might be used to understand the log entry and we should not be mapping the fields automatically.
I think to avoid this we'd need to remove the object_type: keyword and replace that with dynamic: false.
diff --git a/filebeat/module/kibana/log/_meta/fields.yml b/filebeat/module/kibana/log/_meta/fields.yml
index de358a164e..7135593fcb 100644
--- a/filebeat/module/kibana/log/_meta/fields.yml
+++ b/filebeat/module/kibana/log/_meta/fields.yml
@@ -13,7 +13,7 @@
Current state of Kibana.
- name: meta
type: object
- object_type: keyword
+ dynamic: false
- name: meta.req.headers
type: flattened