i am running Packet-beat in my server.
i'm disabled dynamic field in index mapping . it mean if new data coming . don't create new fields.
in my mapping there is not extra field but when i send a request from postman for show records . there is a new field in my result but i'm sure its not in my mapping.
how is possible?
I'm founding the answer.
in elasticsearch when set dynamic:false its mean:
The dynamic setting controls whether new fields can be added dynamically or not. It accepts three settings:
true : Newly detected fields are added to the mapping. (default)
false : Newly detected fields are ignored. These fields will not be indexed so will not be searchable but will still appear in the _source field of returned hits. These fields will not be added to the mapping, new fields must be added explicitly.
strict : If new fields are detected, an exception is thrown and the document is rejected. New fields must be explicitly added to the mapping.
extra description in this link