Cannot get my template to work

Elastic Stack Logstash
15

Hi Aaron,

Persistence pays off or maybe just that I took a break. Anyways... I got it to work :slight_smile:

I boiled the template down to the bare essentials. It appears when I added the "order": 1 to the template it picks up the data types definition b/c it is a higher priority over the default logstash one.

As for the 400 error it must have been something logstash/ES does not like. I have seen quite a few others write about the same. Wish the error message could provide clues where to look.

Here is the template that worked:
{
"template" : "maptest",
"order": 1,
"mappings" : {
"default" : {
"_all" : {"enabled" : false},
"properties" : {
"pk_col": { "type": "string", "index": "not_analyzed","doc_values" : true },
"dt_type": { "type": "date", "index": "not_analyzed", "format": "yyyy-MM-dd HH:mm:ss.SSS", "doc_values" : true},
"int_type": { "type": "integer","doc_values" : true },
"float_type": { "type": "float","doc_values" : true },
"str_type_analyzed": { "type": "string", "index": "analyzed" },
"str_type_not_analyzed": { "type": "string", "index": "not_analyzed" ,"doc_values" : true }
}
}
}
}

The config file:

elasticsearch
{
template_overwrite => true
template_name => "maptest"
manage_template => true
template => "c:/elasticsearch-1.6.0/config/templates/maptest/maptest.json"
host => "localhost"
index => "maptest"
workers => 1
}

1 Like