Deprecated setting, where is it?

I never had 5.x version. started from 6.2. now I am on 6.6.1

I still get following in my log "deprecation.log"

Deprecated field [template] used, replaced by [index_patterns]

Where do I fix this?

In your index templates.

where is that located?

ok found some command to display template, but which one is causing this problem and how do I find that out and fix it?
I am confuse.

is this causing problem?

logstash-index-template" : {
    "order" : 0,
    "index_patterns" : [

May be this log happens when you start logstash?
Or the template has been stored using the old field name "template" instead of "index_patterns".
When you GET the templates the old format is read, transformed on the fly to the new version.
So you should just store it again using just what you got?

this log is elasticsearch deprecation log

I know.

so question is still there.
how do I find where is it and how do I fix it?

That's the question I answered.

Well I didn't upderstand your answer.

anyway. how do I find where the hell this message coming from?

It's coming from an existing template or from an application (logstash) which is sending a PUT template API request.

When upgrading from 6.2 to 6.6.1 did you look at this post?
I'm new at this, Hope this helps in any way possible.

I didn't upgrade straight from 6.2 to 6.6.1. I did all the upgrade, mostly as soon as it came.
as I was new to elk at that time.
David, I understand it is coming from somewhere. but I don't have anywhere reference of template

[root@ ~]# cd /etc/logstash/
[root@ logstash]# grep -i template *

[root@ logstash]# grep -i template /
[root@ logstash]# grep -i template //*

Then I ran GET /_template/*?pretty and look for template, found seven reference but they all are

Then search for patterns and found some. But do not know what this means, do not even know what this template means and where it comes or how do I fix it. or do I even have to worry about it or not
Found three such reference "patterns"

"security-index-template" : {
    "order" : 1000,
    "index_patterns" : [
    "settings" : {
      "index" : {
        "format" : "6",
        "analysis" : {
          "filter" : {
            "email" : {
              "type" : "pattern_capture",
              "preserve_original" : "true",
              "patterns" : [

I see. Can you share the whole output of the GET /_template/ call? You can share it on

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.