# Elasticsearch output template\_name and template index pattern doubt

**URL:** <https://discuss.elastic.co/t/elasticsearch-output-template-name-and-template-index-pattern-doubt/197219>\
**Category:** Elasticsearch\
**Created:** [August 28, 2019, 7:54pm UTC](https://discuss.elastic.co/t/elasticsearch-output-template-name-and-template-index-pattern-doubt/197219 "2019-08-28T19:54:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sebastian\_Herrera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_herrera/32/53209_2.png) [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\
**Post date:** [August 28, 2019, 7:54pm UTC](https://discuss.elastic.co/t/elasticsearch-output-template-name-and-template-index-pattern-doubt/197219/1 "2019-08-28T19:54:30Z")

</div>

Hello i am trying to understand more the flow and privileges of the stack

in my output configuration i have this

```
        hosts => "${ELASTICSEARCH_HOST}"
        ssl => true
        user => "${ELASTICSEARCH_USER}"
        password => "${ELASTICSEARCH_PASS}"
        index => "failure_logs"           
        template_name => "failure_logs"

```

there i am saying that i want to use the template failure\_logs, but what happend if i have a template with index pattern \*, who has the priority, logstash saying that wants to insert in the template, or elasticsearch saying this logs needs to be inserted here?

Thanks

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 29, 2019, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-output-template-name-and-template-index-pattern-doubt/197219/2 "2019-08-29T07:45:21Z")

</div>

Hey,

I am not sure I fully got the question, so I answer what I know. logstash is doing two things here, first putting that template on start up, second indexing documents. Each of those actions requires a dedicated privilege for the user specified. It does not matter what is written in that index template, as long as that privilege exists.

See [https://www.elastic.co/guide/en/logstash/7.3/ls-security.html](https://www.elastic.co/guide/en/logstash/7.3/ls-security.html)

hope this helps, if not, I'm happy to dig deeper 🙂

--Alex

---

<div class="post-metadata">

**Author:** ![Sebastian\_Herrera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_herrera/32/53209_2.png) [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\
**Post date:** [August 29, 2019, 12:55pm UTC](https://discuss.elastic.co/t/elasticsearch-output-template-name-and-template-index-pattern-doubt/197219/3 "2019-08-29T12:55:42Z")

</div>

> [@Sebastian\_Herrera](#):
>
> template\_name =\> "failure\_logs"

Mi question is why i am adding a template\_name in logstash output if then elasticsearch is going to decide base on the index pattern i declared in the templates.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 29, 2019, 2:50pm UTC](https://discuss.elastic.co/t/elasticsearch-output-template-name-and-template-index-pattern-doubt/197219/4 "2019-08-29T14:50:57Z")

</div>

the template name is the unique identifier of the template itself, which needs to be used to create or delete templates. The template name has indeed nothing to do for what indices are template is applied.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2019, 2:51pm UTC](https://discuss.elastic.co/t/elasticsearch-output-template-name-and-template-index-pattern-doubt/197219/5 "2019-09-26T14:51:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.