ELK reindex - no input realtime data

how to assign template to specific elk index

i created the correct index template and migrated the data from the old index but it is not written further in real time

How to make it write? (used by fluentd)

To assign a dynamic template to an existing index you need to use to update the mapping.

1 Like

try input this but

PUT /_template/test_template
{
  "index_patterns" : [
    "test*"
  ],
  "mappings": {
    "dynamic_templates": [
      {
        "strings": {
          "match_mapping_type": "string",
          "mapping": {
            "type": "text",
            "fields": {
              "keyword": {
                "type":  "keyword",
                "ignore_above": 1024
              }
            }
          }
        }
      }
    ]
  }
}

but have next issue - legacy format not modern

#! legacy template [test_templatee] has index patterns [test*] matching patterns from existing composable templates [default,test.logs,test.sp] with patterns (default => [*],test.logs => [monitor*, fluentd*, sandbox*, test*, staging*],test.sp => [test.sp.services.log*, staging.sp.services.log*]); this template [test_templatee] may be ignored in favor of a composable template at index creation time
#! Legacy index templates are deprecated in favor of composable templates.
{
  "acknowledged" : true
}