Custom elasticsearch template

Elastic Stack Beats
1

I'm trying to load a custom elasticsearch template when filebeat starts up. The relevant part of my latest filebeat.yml looks like:

output.elasticsearch:
  enabled: true
  hosts: ["<%= @elasticsearch %>:443"]
  protocol: "https"
  index: "audit-%{+yyyyMMdd}"

setup.template:
  name: 'audit'
  pattern: 'audit-*'
  json:
    enabled: true
    path: 'audit.template.json'
    name: 'audit'
  enabled: true
  settings:
    index.number_of_shards: 3

But a default mapping is applied to the index and no template is defined. The docs say the setup.template.json.* options are experimental, so not sure if they do indeed work.

Regardless, how can I load a json template defined in audit.template.json? I've tried every option combination based on reading the docs and can't get it to work.

Thanks.

2

Assuming that the template has the structure expected by the _template API, you can simply upload your template with curl or the Kibana console.

See the metricbeat documentation on how to export templates from metricbeat.

3

Thanks. Yes, I'm able to install the template manually, but just hoping to have filebeat do it. I'm doing all of this in chef, so I just added some curl goodness to do it that way.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.