# Can't creat a Template **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 24, 2017, 10:20am UTC](https://discuss.elastic.co/t/cant-creat-a-template/109010 "2017-11-24T10:20:46Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![davidsoler95](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@davidsoler95](https://discuss.elastic.co/u/davidsoler95)\ **Post date:** [November 24, 2017, 10:20am UTC](https://discuss.elastic.co/t/cant-creat-a-template/109010/1 "2017-11-24T10:20:47Z")
Hi, After two days trying basic stuff y can' t do that Filebeat and Kibana read my data log and split in my JSON fields to use the Kibana visualization tools, using the 5.6.4 version (last x32 bits version) Our logs are in JSON with the following fields: `{"@timestamp":"2017-10-03T23:50:15.000Z","EMP":"BAL","INST":"PRI","TIPO":"T2","MSG":"FPS STATS COV : E=0/M=946/A=0 ","MOD":"AbdFPS","FNT":"fpsCbTimerVaciado.c","LIN":"83","ID1":0,"ID2":946,"ID3":0,"STR1":"","STR2":"","STR3":""}` So, in Filebeat folder I've created a file `prueba.template.json` like the original one. I've edited it with the information of my fields. I think this file is wrong, but I think file isn't loaded in Kibana. `prueba.template.json` - [https://pastebin.com/uXxrQD9i](https://pastebin.com/uXxrQD9i) In filebeat.yml I've tried to load the template file `filebeat.yml` - [https://pastebin.com/jQb9R30d](https://pastebin.com/jQb9R30d) - Running Filebeat, ElasticSearch and Kibana and I've detected that log files are loaded but not the template. Arranco Filebeat, ElasticSearch y Kibana y detecto que si que se cargan los archivos de Log pero no el template. Let's go to Kibana and load the index pattern "filebeat-\*" and ![1](https://us1.discourse-cdn.com/elastic/original/3X/0/7/0753d01f67f88dab52a42a5c4ff16046df140e61.png) ![2](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e54e9305a286d97d7a1aa1191aaf5c28beaa37e8.png) There are apache fields that I've deleted on `prueba.template.json` and my fields are not shown. If I go to discover can see that the content in `message` (the interesting one) is not processed. ![3](https://us1.discourse-cdn.com/elastic/original/3X/7/f/7f6985d2902787e43564c09752e97b47159abc37.png) Help a newbie ☹ ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 26, 2017, 11:26pm UTC](https://discuss.elastic.co/t/cant-creat-a-template/109010/2 "2017-11-26T23:26:11Z")
There are two things: index template which is for Elasticsearch and the index pattern which is for Kibana. The index template that you linked above is for elasticsearch and does not have a direct affect on Kibana. The config options you are looking for under `5.6` are under `dashboard.*`. Having said all the above, I'm curious what you are trying to do. If you have json logs, you need to tell filebeat to decode the json. So I think your issue is more in the filebeat config then with the template and index pattern. Can you share your filebeat config and how you start filebeat? ---
**Author:** ![davidsoler95](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@davidsoler95](https://discuss.elastic.co/u/davidsoler95)\ **Post date:** [November 27, 2017, 11:03am UTC](https://discuss.elastic.co/t/cant-creat-a-template/109010/3 "2017-11-27T11:03:16Z")
Hi, thanks for you response. Yes, we have JSON logs and we want to tell filebeat to decode the JSON. We can't install filebeat service with PowerShell because we have not permissions to install in the corporate machine that filebeat is running (long history...) . Does that have something to do with our problem? The config `filebeat.yml` --\> [https://pastebin.com/EpuUAyc8](https://pastebin.com/EpuUAyc8) `filebeat.template.json` ---\> [https://pastebin.com/FyGzeUJV](https://pastebin.com/FyGzeUJV) To open filebeat Command Line in Filebeat folder and \>`filebeat -c filebeat.yml -e` Anything else? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 29, 2017, 1:54am UTC](https://discuss.elastic.co/t/cant-creat-a-template/109010/4 "2017-11-29T01:54:09Z")
Can you use the file output and read in some log files and share the output? I wonder if the decoding worked as expected. Please also share the filebeat log output. Three things from the config: - Indentation on `setup.kibana` is wrong - Template config should be under `setup` but seems to be under output now? - You still have the default path (/var/log/\*) in your config. Is that on purpose? It seems you copied together the config but missed some important parts. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 27, 2017, 1:54am UTC](https://discuss.elastic.co/t/cant-creat-a-template/109010/5 "2017-12-27T01:54:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.