ElasticSearch custom index and mapping | local json data visualization issue

I assume you actually want this to be ongoing so yes you will need to use filebeat...

Pretty sure you are making a common mistake ...

Assuming you created your own template manually in Kibana / Elasticsearch then take out all that setup template stuff out and try what I have below ... mostly likely what you have it is just overwriting your template

# ================================== Template ==================================

# A template is used to set the mapping in Elasticsearch
# By default template loading is enabled and the template is loaded.
# These settings can be adjusted to load your own template or overwrite existing ones.

# Set to false to disable template loading.
setup.template.enabled: true

# Template name. By default the template name is "filebeat-%{[agent.version]}"
# The template name and pattern has to be set in case the Elasticsearch index pattern is modified.
setup.template.name: "darpa-%{[agent.version]}"

# Template pattern. By default the template pattern is "filebeat-%{[agent.version]}" to apply to the default index settings.
# The template name and pattern has to be set in case the Elasticsearch index pattern is modified.
setup.template.pattern: "darpa-%{[agent.version]}"

# Set to false to disable template loading.
setup.template.enabled: true
......

Just put this in this .. it says use what I manually loaded.

setup.template.enabled: false
setup.ilm.enabled: false

You can look at some of my other examples etc

1 Like