# Dynamic Template not working after upgrading to Elasticsearch 2.3.1

**URL:** <https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475>\
**Category:** Elasticsearch\
**Created:** [April 26, 2016, 8:02pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475 "2016-04-26T20:02:16Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sharon.c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharon.c/32/16076_2.png) [@sharon.c](https://discuss.elastic.co/u/sharon.c)\
**Post date:** [April 26, 2016, 8:02pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475/1 "2016-04-26T20:02:17Z")

</div>

I just upgraded the elasticsearch from 2.0 to 2.3.1  
It is strange that the templates I used to use were working in 2.0, but not working in 2.3.1  
The same logstash instance I was using to inject the same docs, but the docs are using the template I defined.

This is my template definition

> curl -XPUT '[http://staging-elkstack:9200/\_template/elkstats\_template](http://staging-elkstack:9200/_template/elkstats_template)' -d '  
> {  
> "order" : 2,  
> "template": "template\_test\*",  
> "settings": {  
> "number\_of\_shards" : 8,  
> "number\_of\_replicas" : 0  
> },  
> "mappings" : {  
> "log" : {  
> "\_all" : {"enabled" : false, "omit\_norms" : true},  
> "dynamic\_templates" : [ {  
> "message\_field" : {  
> "match" : "message",  
> "match\_mapping\_type" : "string",  
> "mapping" : {  
> "type" : "string", "index" : "not\_analyzed", "omit\_norms" : true  
> }  
> }  
> }, {  
> "string\_fields" : {  
> "match" : "\*",  
> "match\_mapping\_type" : "string",  
> "mapping" : {  
> "type" : "string", "index" : "not\_analyzed", "omit\_norms" : true  
> }  
> }  
> }  
> ],  
> "properties" : {  
> "@timestamp": { "type": "date", "doc\_values" : true },  
> "@version": { "type": "string", "index": "not\_analyzed", "doc\_values" : true },  
> "geopoint": {  
> "type": "geo\_point"  
> }  
> }  
> }  
> }  
> }  
> '

This is my logstash .conf file output part

> 

input{stdin{}}  
filter {  
json { source =\> "message" }  
}  
output {  
stdout { codec =\> rubydebug }  
elasticsearch {  
hosts =\> "staging-elkstack:9200"  
index =\> "template\_test"  
template\_name =\> "elkstats\_template"  
}  
}

To test the logstash conf, you can use this input

> 

{ "longitude":-73.758, "latitude":41.0291}

---

<div class="post-metadata">

**Author:** ![sharon.c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharon.c/32/16076_2.png) [@sharon.c](https://discuss.elastic.co/u/sharon.c)\
**Post date:** [April 27, 2016, 5:05pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475/3 "2016-04-27T17:05:36Z")

</div>

My problem is that in the the dynamic\_templates , I set all the strings ("match" : "\*") should not be analysed. But in reality, the string field like host field is still analysed. As you can see in the picture below: host, tag, and message should not be analysed. But in reality they are analyzed

 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/106fd22f624dfb44e381adce5f1fdbcc310143ba.png)

---

<div class="post-metadata">

**Author:** ![sharon.c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharon.c/32/16076_2.png) [@sharon.c](https://discuss.elastic.co/u/sharon.c)\
**Post date:** [April 27, 2016, 9:51pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475/4 "2016-04-27T21:51:48Z")

</div>

When I used the previous versions, they are all fine, but after I upgraded to 2.3, logstash does not pick up the dynamic\_templates.

---

<div class="post-metadata">

**Author:** ![sharon.c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharon.c/32/16076_2.png) [@sharon.c](https://discuss.elastic.co/u/sharon.c)\
**Post date:** [April 27, 2016, 11:14pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475/5 "2016-04-27T23:14:22Z")

</div>

My question is: can you give me a simple example to define a dynamic template, for all the string fields, make them not analysed?

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 29, 2016, 4:20pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475/6 "2016-04-29T16:20:11Z")

</div>

Could you do an XGET to make sure the template is in ES?

> [@sharon.c](#):
>
> "all" : {"enabled" : false, "omitnorms" : true},

Shouldn't it be `"_all"`?

Below is my working dynamic template on ES 2.3.0 and Logstash 2.3.0

```auto
"dynamic_templates": [
        {
          "string_fields": {
            "mapping": {
              "index": "not_analyzed",
              "omit_norms": true,
              "type": "string"
            },
            "match_mapping_type": "string",
            "match": "*"
          }
        }
      ],

```

---

<div class="post-metadata">

**Author:** ![sharon.c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharon.c/32/16076_2.png) [@sharon.c](https://discuss.elastic.co/u/sharon.c)\
**Post date:** [April 29, 2016, 6:59pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475/7 "2016-04-29T18:59:49Z")

</div>

I was using "\_all", Not sure how come the underline is not showing in this page. Thank you, I will try your template format.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:55pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-after-upgrading-to-elasticsearch-2-3-1/48475/8 "2017-07-05T22:55:09Z")

</div>