Disable logstash default template creation


(Jaminvp) #1

Greetings,

I have an issue with Logstash constantly creating a template corresponding to one of my indexes, which messes with the parsing of the fields.

I have 4 indexes, let's call them "foo","fii","faa","fee".

When I don't do something about it, logstash/elasticsearch immediately creates the following template:

{-

"logstash" : {-

"order" : 0,

"template" : "foo",

"settings" : {-

...
}
}

With my custom template below this one:

"f_template" : {-

"order" : 0,

"template" : "f*",

"settings" : {-
...
}
}
Is there a way to prevent elasticsearch/logstash adding the first template and linking it to "foo"?

Update: I fixed it in a dirty way by changing the logstash template "template"-field to "logstash-*" using a POST-query, removing the foo index and resending all the foo-logs.


(Mark Walkom) #2

You can also use https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-manage_template


(system) #3