We need to remove a list of index-time extracted fields while keeping the _raw data, is this possible?
The reason this came to be was we were previously using the search-time json extraction
KV_MODE=JSON
until we went for the 6.2 recommended approach,
index-time field extraction
INDEXED_EXTRACTIONS=json
obviously as soon as we set KV_MODE=none at the search head for this sourcetype (to get rid of the duplicated fields)
this only started adding the metadata for the new events coming in since that change,
guaranteeing we lost search capability over those fields (keeping spath out of the discussion) in the historical data until then.
We have to revert to the previous behaviour (search time extraction) as that historical data didn't have those fields at the time.
Help is welcome.
Once data is indexed you cannot surgically remove fields. You would need to dump the data and then re-index with the correct extraction.