Converting filebeat.template.json to fields.yml

Elastic Stack Beats
1

I am in the process of upgrading from filebeat 5 alpha 4 (-: to latest 6.5.1

How do I convert filebeat.template.json to fields.yml? Whats the syntax for the first part of the document with mappings and dynamic_templates?

{

"mappings": {
"default": {
"_all": {
"norms": false
},
"dynamic_templates": [
{
"fields": {
"mapping": {
"ignore_above": 1024,
"type": "keyword"
},
"match_mapping_type": "string",
"path_match": "fields."
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"beat": {
"properties": {
"hostname": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"input_type": {
"ignore_above": 1024,
"type": "keyword"
},
"message": {
"norms": false,
"type": "text"
},
"offset": {
"type": "long"
},
"source": {
"ignore_above": 1024,
"type": "keyword"
},
"tags": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
},
"order": 0,
"settings": {
"index.refresh_interval": "5s"
},
"template": "filebeat-"
}

2

@Martin_H_Andersen I think the command I've referenced in your other post will help: {beatname} export template

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.