Changing the Metricbeat template

[TimWard]

How do I override bits of the usual metricbeat template? - I want beat.hostname to be treated as both text and keyword, but all my attempts so far to hack around in the default generated template fail with errors when I try to create the index, possibly because the dynamic_template clashes with an explicit mapping??

2018-03-16T16:42:04Z WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_default
_]: Mapping definition for [hostname] has unsupported parameters: [ignore_above : 1024]","caused_by":{"type":"mapper_parsing_exception","
reason":"Mapping definition for [hostname] has unsupported parameters: [ignore_above : 1024]"}}

[TimWard]

Oh, looks like the problem is that my own template has a different name to the one that Metricbeat installs, so Elasticsearch tries to apply both, and they clash. Next thing to try is deleting the automatic one and configuring Metricbeat not to install its own template.

[andrewkroh]

You can approach this in more than one way.

You can export the default template from Metricbeat, modify it, and manage the template installation yourself.

metricbeat export template > metricbeat-<version>.template.json
# Edit to setup a multi-field
# Load the template with curl

You could also modify the fields.yml file to set beat.hostname as a multi-field (example). And have the Beat install the updated template.

# Modify /etc/metricbeat/fields.yml as per the example.

# Install updated template.
metricbeat setup --template -E setup.template.overwrite=true