# Elasticsearch ignoring custom template file defined in Logstash

**URL:** https://discuss.elastic.co/t/elasticsearch-ignoring-custom-template-file-defined-in-logstash/75016
**Category:** Elasticsearch
**Created:** [February 14, 2017, 11:20am UTC](https://discuss.elastic.co/t/elasticsearch-ignoring-custom-template-file-defined-in-logstash/75016 "2017-02-14T11:20:12Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [February 14, 2017, 11:20am UTC](https://discuss.elastic.co/t/elasticsearch-ignoring-custom-template-file-defined-in-logstash/75016/1 "2017-02-14T11:20:12Z")

</div>

Hi,

I use ELK GA 5.0.0. I push to kafka using filebeat, then I consume it using logstash. Everything works fine, I pulled mapping from elasticsearch using `curl` like;

```
curl -XGET 'localhost:9200/my-logs-2016-11-11/_mapping?pretty' --user elastic:elasticpassword

```

which gave me;

```
{
  "my-logs-2016-11-11" : {
    "mappings" : {
      "logfile" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date"
          },
          "@version" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "beat" : {
            "properties" : {
              "hostname" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "name" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "version" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              }
            }
          },
          "fields" : {
            "properties" : {
              "logtype" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              }
            }
          },
          "reference" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "message" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "offset" : {
            "type" : "long"
          }
        }
      }
    }
  }
}

```

I wanted to give it a custom mapping, so that I created a mapping json file like;

```
{
  "template": "my-logs-*",{
    "mappings" : {
      "logfile" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date"
          },
          "@version" : {
            "type": "int"
          },
          "beat" : {
            "properties" : {
              "hostname": {
                "index": "not_analyzed",
                "type": "string"
              },
              "name": {
                "index": "not_analyzed",
                "type": "string"
              },
              "version": {
                "index": "not_analyzed",
                "type": "string"
              }
            }
          },
          "fields" : {
            "properties" : {
              "logtype": {
                "index": "not_analyzed",
                "type": "string"
              }
            }
          },
          "reference" : {
            "type" : "long"
          },
          "message" : {
            "index": "not_analyzed",
                "type": "string"
          },
          "offset" : {
            "type" : "long"
          }
        }
      }
    }
  }
}

```

In logstash, i use;

```
output{
	stdout{ codec => json }
	elasticsearch {
		template => "/ELK/logstash-5.0.0/mylogsmap.json"
		template_overwrite => true
		hosts => ["192.168.0.1"]
		index => "my-logs-%{+YYYY-MM-dd}"
		user => elastic
		password => elasticpassword
	}
}	

```

But still, I am getting the previous mapping. I have deted all indices and re indexed, but still new indices are having old mapping. How can I fix this?

Thanks in advance.

---

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [February 15, 2017, 3:46am UTC](https://discuss.elastic.co/t/elasticsearch-ignoring-custom-template-file-defined-in-logstash/75016/2 "2017-02-15T03:46:25Z")

</div>

somebody tell me why this is happening? 😞

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 15, 2017, 3:47am UTC](https://discuss.elastic.co/t/elasticsearch-ignoring-custom-template-file-defined-in-logstash/75016/3 "2017-03-15T03:47:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.