You've seen https://www.elastic.co/guide/en/elasticsearch/reference/5.1/indices-templates.html?
In the first example, this part "template": "te*",
is a pattern that matches the index name. So an index of name test
or template
will all match but today-20171231
won't.
So if you are looking at the logstash-*
template and your index is cisco-$DATE
, then that would explain things.