Why do we need templates even though we have logstash configuraion files or the question would be reiterated as what is the difference between logstash's configuration file and elastic's template file? (Here what I mean to say is if we can change some types using mutate in logstash conf file, why do we need templates? Am I looking at it completely wrong?)
When you cast fields in Logstash, you change the way they are represented in the JSON documents sent to Elasticsearch. That is why you have a limited number of types to choose from.
When this reaches Elasticsearch, the index template tells Elasticsearch how these fields should be interpreted. If no template is present, Elasticsearch will attempt to use dynamic mapping, but there is a limit to what it can map automatically, and this does not include e.g. IP and geo_ip fields.
Thanks @Christian_Dahlqvist for the reply.
Those fields are the main reason why I asked this question continuing from this one. So what are the pros and cons of not mapping ip's as type 'ip' and instead leaving them as strings? Which one should we prefer? (The same with geo_ip as well?) Thanks 
in advance.
Well, geo_ip fields need to be mapped if you are going to be able to use maps. When it comes to IP fields the ideal mapping depends on how you want to be able to query them.
Does it make any difference as far as storage is concerned?
And if queries are mostly range based queries which is better?
I would map it as ip type as it supports IP range aggregations and probably takes up less space.
Thank you very much @Christian_Dahlqvist
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.