Currently Beats use a single datastream/index template with the mappings for every possible module, making the mappings huge. We've just crossed the line of 10,000 fields in a index with metricbeat 8.15 (see here) had to increased it even further.
A better approach would be to have a dedicated datastream per module, so each datastream/index template would have only the necessary mappings for its module.
This issue aims to evaluate:
the impact of having dedicated datastreams per module, specially in regard to backward compatibility for queries and dashboards
how the beats would need to be adapted to start shipping data to different datastreams
Describe a specific use case for the enhancement or feature:
Describe the enhancement:
Currently Beats use a single datastream/index template with the mappings for every possible module, making the mappings huge. We've just crossed the line of 10,000 fields in a index with metricbeat 8.15 (see here) had to increased it even further.
A better approach would be to have a dedicated datastream per module, so each datastream/index template would have only the necessary mappings for its module.
This issue aims to evaluate:
Describe a specific use case for the enhancement or feature: