# Attempting to Install template **URL:** \ **Category:** Logstash\ **Created:** [November 10, 2021, 2:46pm UTC](https://discuss.elastic.co/t/attempting-to-install-template/288899 "2021-11-10T14:46:31Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Post date:** [November 10, 2021, 2:46pm UTC](https://discuss.elastic.co/t/attempting-to-install-template/288899/1 "2021-11-10T14:46:31Z")
Good Morning Logstash experts. As most of you know I have been working on injesting and being able to see the syslogs that are being sent directly to my logstash server. When I run a debug on my logstash I see the following: ```auto [logstash.log][DEBUG] Attempting to install template {:template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}} 08:26:33.460 logstash.log [logstash.log][DEBUG] Attempting to install template {:template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}} 08:26:33.464 logstash.log [logstash.log][DEBUG] Found existing Elasticsearch template, skipping template management {:name=>"logstash"} 08:26:33.467 logstash.log [logstash.log][DEBUG] Found existing Elasticsearch template, skipping template management {:name=>"logstash"} ``` Looking at that it appears that it is trying to create a template but is not being able to do so. If I locate the "logstash" template that is being seen and delete it, will that solve my issue and allow me to view the syslogs that are being directed to my logstash? ---
**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Post date:** [November 10, 2021, 6:58pm UTC](https://discuss.elastic.co/t/attempting-to-install-template/288899/2 "2021-11-10T18:58:54Z")
More information, if it will help. The lines immediately following the 4 above regarding the Attempting to install template are: ````auto [logstash.log][DEBUG] Found existing Elasticsearch template, skipping template management {:name=>"logstash"} 13:40:17.181 logstash.log [logstash.log][INFO] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/logstash-sample.conf"], :thread=>"#"} 13:40:17.183 logstash.log [logstash.log][DEBUG] Found existing Elasticsearch template, skipping template management {:name=>"logstash"} 13:40:17.573 logstash.log [logstash.log][DEBUG] Compiled output P[output-elasticsearch{"hosts"=>["http://ES_IP_Addy:9200"], "index"=>"%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}", "user"=>"ES_User", "password"=>"ES_User_Pass"}|[file]/etc/logstash/logstash-sample.conf:22:3:``` elasticsearch { hosts => ["http://ES_IP_addy:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" user => "ES_User" password => "ES_User_Pass" } ```] into org.logstash.config.ir.compiler.ComputeStepSyntaxElement@3fdc2b9c 13:40:17.573 logstash.log [logstash.log][DEBUG] Compiled output P[output-elasticsearch{"hosts"=>["http://ES_IP_Addy:9200"], "index"=>"%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}", "user"=>"ES_User", "password"=>"ES_User_Pass"}|[file]/etc/logstash/logstash-sample.conf:22:3:``` elasticsearch { hosts => ["http://ES_IP_Addy:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" user => "_ES_User" password => "ES_User_Pass" } ```] into org.logstash.config.ir.compiler.ComputeStepSyntaxElement@3fdc2b9c 13:40:17.574 logstash.log [logstash.log][DEBUG] Compiled output P[output-elasticsearch{"hosts"=>["http://ES_IP_Addy:9200"], "index"=>"%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}", "user"=>"ES_User", "password"=>"ES_User_Pass"}|[file]/etc/logstash/logstash-sample.conf:22:3:``` elasticsearch { hosts => ["http://ES_IP_Addy:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" user => "ES_User" password => "ES_User_Pass" } ```] into org.logstash.config.ir.compiler.ComputeStepSyntaxElement@3fdc2b9c 13:40:17.576 logstash.log [logstash.log][DEBUG] Compiled output P[output-elasticsearch{"hosts"=>["http://ES_IP_addy:9200"], "index"=>"%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}", "user"=>"ES_user", "password"=>"ES_User_pass"}|[file]/etc/logstash/logstash-sample.conf:22:3:``` elasticsearch { hosts => ["http://ES_IP_Addy:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" user => "ES_User" password => "ES_Pass" } ```] into org.logstash.config.ir.compiler.ComputeStepSyntaxElement@3fdc2b9c ```` So it looks like it is trying to use "logstash" as the index??? Am I reading it correctly? Please help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 8, 2021, 6:59pm UTC](https://discuss.elastic.co/t/attempting-to-install-template/288899/3 "2021-12-08T18:59:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.