problem with dynamic field elastic search

Question

i am running Packet-beat in my server.

i'm disabled dynamic field in index mapping . it mean if new data coming . don't create new fields.

in my mapping there is not extra field but when i send a request from postman for show records . there is a new field in my result but i'm sure its not in my mapping.

how is possible?

Answer 1

I'm founding the answer.

in elasticsearch when set dynamic:false its mean:

The dynamic setting controls whether new fields can be added dynamically or not. It accepts three settings:

true : Newly detected fields are added to the mapping. (default)

false : Newly detected fields are ignored. These fields will not be indexed so will not be searchable but will still appear in the _source field of returned hits. These fields will not be added to the mapping, new fields must be added explicitly.

strict : If new fields are detected, an exception is thrown and the document is rejected. New fields must be explicitly added to the mapping.

extra description in this link