# Changing the Metricbeat template

**URL:** https://discuss.elastic.co/t/changing-the-metricbeat-template/124335
**Category:** Beats
**Tags:** metricbeat
**Created:** [March 16, 2018, 4:54pm UTC](https://discuss.elastic.co/t/changing-the-metricbeat-template/124335 "2018-03-16T16:54:16Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![TimWard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timward/32/19574_2.png) [@TimWard](https://discuss.elastic.co/u/TimWard)
#### Post date: [March 16, 2018, 4:54pm UTC](https://discuss.elastic.co/t/changing-the-metricbeat-template/124335/1 "2018-03-16T16:54:16Z")

</div>

How do I override bits of the usual metricbeat template? - I want beat.hostname to be treated as both text and keyword, but all my attempts so far to hack around in the default generated template fail with errors when I try to create the index, possibly because the dynamic\_template clashes with an explicit mapping??

> 2018-03-16T16:42:04Z WARN Can not index event (status=400): {"type":"mapper\_parsing\_exception","reason":"Failed to parse mapping [\_default  
> \_]: Mapping definition for [hostname] has unsupported parameters: [ignore\_above : 1024]","caused\_by":{"type":"mapper\_parsing\_exception","  
> reason":"Mapping definition for [hostname] has unsupported parameters: [ignore\_above : 1024]"}}

---

<div class="post-metadata">

### Author: ![TimWard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timward/32/19574_2.png) [@TimWard](https://discuss.elastic.co/u/TimWard)
#### Post date: [March 19, 2018, 9:35am UTC](https://discuss.elastic.co/t/changing-the-metricbeat-template/124335/2 "2018-03-19T09:35:29Z")

</div>

Oh, looks like the problem is that my own template has a different name to the one that Metricbeat installs, so Elasticsearch tries to apply both, and they clash. Next thing to try is deleting the automatic one and configuring Metricbeat not to install its own template.

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [March 20, 2018, 3:39pm UTC](https://discuss.elastic.co/t/changing-the-metricbeat-template/124335/3 "2018-03-20T15:39:47Z")

</div>

You can approach this in more than one way.

You can export the default template from Metricbeat, modify it, and [manage the template installation](https://www.elastic.co/guide/en/beats/metricbeat/6.2/metricbeat-template.html#load-template-manually) yourself.

```auto
metricbeat export template > metricbeat-<version>.template.json
# Edit to setup a multi-field
# Load the template with curl

```

You could also modify the `fields.yml` file to set `beat.hostname` as a multi-field ([example](https://github.com/elastic/beats/blob/9fe7b1fe1157c4d48007815e5ea1e8e22f8b8f05/auditbeat/module/audit/file/_meta/fields.yml#L6-L14)). And have the Beat install the updated template.

```auto
# Modify /etc/metricbeat/fields.yml as per the example.

# Install updated template.
metricbeat setup --template -E setup.template.overwrite=true

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 17, 2018, 3:40pm UTC](https://discuss.elastic.co/t/changing-the-metricbeat-template/124335/4 "2018-04-17T15:40:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
