Copy logstash template

Elastic Stack Logstash
1

i would like to copy logstash template to a newname template. I did a GET _template/logstash , copied and edited (replace the word "logstash" with "blah")

Did a PUT but got an error of:

{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "unknown key [blah] in the template "
      }
    ],
    "type": "parse_exception",
    "reason": "unknown key [blah] in the template "
  },
  "status": 400
}

PUT _template/blah

{
  "blah" : {
    "order" : 0,
    "version" : 60001,
    "index_patterns" : [
      "blah-*"
    ],
    "settings" : {
      "index" : {
        "number_of_shards" : "1",
        "refresh_interval" : "5s"
      }
    },
    "mappings" : {
      "dynamic_templates" : [
        {
          "message_field" : {
            "path_match" : "message",
            "mapping" : {
              "norms" : false,
              "type" : "text"
            },
            "match_mapping_type" : "string"
          }
        },
        {
          "string_fields" : {
            "mapping" : {
              "norms" : false,
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "ignore_above" : 256,
                  "type" : "keyword"
                }
              }
            },
            "match_mapping_type" : "string",
            "match" : "*"
          }
        }
      ],
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "geoip" : {
          "dynamic" : true,
          "properties" : {
            "ip" : {
              "type" : "ip"
            },
            "latitude" : {
              "type" : "half_float"
            },
            "location" : {
              "type" : "geo_point"
            },
            "longitude" : {
              "type" : "half_float"
            }
          }
        },
        "@version" : {
          "type" : "keyword"
        }
      }
    },
    "aliases" : { }
  }
}

How do I copy logstash template? such that i can use "blah" in my index names?

thanks!
Sirjune

2

Please edit your post and format it so that special characters are not consumed as markup. Select the text of your template and click on </> in the toolbar above the edit pane. The appearence of the selected text will change to look

    like this
3

Thanks @Badger! i formatted the original post.

4

You cannot take the output of "GET _template" and feed it to "PUT _template" without modification. You can do a GET on more than one template at a time, so the structure of the output is

{
"templateName1": { contents of template1 },
"templateName2": { contents of template2 }
}

If you just fetch one template it still uses that structure

{ "templateName1": { contents of template } }

So for the PUT you need to remove the leading { "blah" : and the trailing }

Take a look at this to see an example of what you would PUT.

5

Thanks much @Badger! I was able to create a new template. My target is to (at least) have the geoip mappings without "logstash" prefix in my index name.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.