Greetings,
I have an issue with Logstash constantly creating a template corresponding to one of my indexes, which messes with the parsing of the fields.
I have 4 indexes, let's call them "foo","fii","faa","fee".
When I don't do something about it, logstash/elasticsearch immediately creates the following template:
{-
"logstash" : {-
"order" : 0,
"template" : "foo",
"settings" : {-
...
}
}
With my custom template below this one:
"f_template" : {-
"order" : 0,
"template" : "f*",
"settings" : {-
...
}
}
Is there a way to prevent elasticsearch/logstash adding the first template and linking it to "foo"?
Update: I fixed it in a dirty way by changing the logstash template "template"-field to "logstash-*" using a POST-query, removing the foo index and resending all the foo-logs.