Adding _size field to index template

Elastic Stack Elasticsearch
1

I'm running ES 8.13.4, attempting to add the _size field to an index template.

I have successfully installed the _size plugin on all nodes on the cluster, confirmed by issuing GET /_cat/plugins

When I issue:

PUT /_index_template/filebeat-8.14.3/
{
  "mappings": {
    "_size": {
      "enabled": true
    }
  }
}

I get the following response:

{
  "error": {
    "root_cause": [
      {
        "type": "x_content_parse_exception",
        "reason": "[2:3] [index_template] unknown field [mappings]"
      }
    ],
    "type": "x_content_parse_exception",
    "reason": "[2:3] [index_template] unknown field [mappings]"
  },
  "status": 400
}

As a bonus question, how do I make changes like this survive Filebeat updates? It seems like a new index template is created whenever Filebeat is updated. Is there a....template for templates?

2 
PUT /_index_template/filebeat-8.14.3
{
  "index_patterns": ["filebeat-8.14.3-*"],
  "template": {
    "mappings": {
      "_size": {
        "enabled": true
      },
// your other mappings
    }
  }
}

See: Create or update index template API | Elasticsearch Guide [8.14] | Elastic

3

Thank you. My current mapping for that template is 27k lines long. So... download my current mapping, stick this in there somewhere and PUT it in again?