I have template which is in fact copy&paste of my current auto mappings with two field types change to geo_point but when I try to load it, actual mappings do not change ?
output {
if [type] =="pa-traffic" {
elasticsearch {
##protocol =>"node"
hosts => "elasticsearch:9200"
index =>"pa-traffic-%{+YYYY.MM.dd}"
#cluster => elastic-cluster-neteng-syslog
template => "/opt/elasticsearch-template.json"
template_overwrite => true
}
#stdout { codec => rubydebug }
}
}
and
$ head /opt/elasticsearch-template.json
{
"template": "pa-*",
"settings" : {
"index.refresh_interval" : "5s"
},
{
"mappings": {
"pa-traffic": {
"properties": {
I found this in logs, line: 6, column: 2 is just '{' before "mappings"
[2016-11-09T21:25:36,606][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Unexpected character ('{' (code 123)): was expecting double-quote to start field name\n at [Source: [B@22c6094b; line: 6, column: 2]", :class=>"LogStash::Json::ParserError"}
[2016-11-09T21:25:36,607][INFO ][logstash.outputs.elasticsearch]
