Dynamic Template Mapping not Being Applied

Elastic Stack Elasticsearch
1

I have placed a template mapping for an index that doesn't seem to be being applied when a new matching index is created, and I can't seem to figure out why. The template is supposed to make all string fields in an index "not_analyzed". I have even used this identical dynamic template on other indices and had it work. This is the template:

{ "nginx" : { "order" : 0, "template" : "x-*-nginx-*", "settings" : { "index" : { "refresh_interval" : "5s" } }, "mappings" : { "nginx" : { "dynamic_templates" : [ { "notanalyzed" : { "mapping" : { "index" : "not_analyzed", "doc_values" : "true", "type" : "string" }, "match_mapping_type" : "string", "match" : "*" } } ] } }, "aliases" : { } } }

and here is the mapping of the index that created that should have applied that template, but didnt:

{ "x-holding-nginx-2016.03.30" : { "aliases" : { }, "mappings" : { "nginx" : { "properties" : { "@timestamp" : { "type" : "date", "format" : "strict_date_optional_time||epoch_millis" }, "@version" : { "type" : "string" }, "agent" : { "type" : "string" }, "auth" : { "type" : "string" }, "beat" : { "properties" : { "hostname" : { "type" : "string" }, "name" : { "type" : "string" } } }, "bytes" : { "type" : "long" }, "client" : { "type" : "string" }, "clientip" : { "type" : "string" }, "count" : { "type" : "long" }, "device" : { "type" : "string" }, "errormessage" : { "type" : "string" }, "fields" : { "properties" : { "type" : { "type" : "string" } } }, "geoip" : { "properties" : { "area_code" : { "type" : "long" }, "city_name" : { "type" : "string" }, "continent_code" : { "type" : "string" }, "country_code2" : { "type" : "string" }, "country_code3" : { "type" : "string" }, "country_name" : { "type" : "string" }, "dma_code" : { "type" : "long" }, "ip" : { "type" : "string" }, "latitude" : { "type" : "double" }, "location" : { "type" : "double" }, "longitude" : { "type" : "double" }, "postal_code" : { "type" : "string" }, "real_region_name" : { "type" : "string" }, "region_name" : { "type" : "string" }, "timezone" : { "type" : "string" } } }, "host" : { "type" : "string" }, "httpversion" : { "type" : "string" } } } } } }

2

Figured out the problem guys. I set the new template at ~8:30PM US-Eastern time, but because elasticsearch was working in UTC, it had ALREADY started the days new indices before I set the template. Silly mistake, but worth noting, watch your time zones people.

thanks!