Error with manage_template on multiple elasticsearch outputs

[tmccoy (Tyler)]

Hi, thanks in advance for your assistance!

Description:
I have an output configuration where I am using an if statement to select an output to elasticsearch, essentially I want to index documents into an index depending on the contents of the event-type field, as well as have logstash manage the templates and ILM. I have two indexes/templates auth and other.

Here's an example configuration of what I am trying to do:

output {
if [event_type] == "auth" {
elasticsearch {
hosts => ["http://example-host:9200"]
user => "test-user"
password => "test-password"
template_name => "auth"
manage_template => true
template => "/etc/logstash/mappings/auth.json"
template_overwrite => true
doc_as_upsert => true
document_id => "%{id}"
ilm_enabled => true
ilm_rollover_alias => "auth-events"
ilm_policy => "auth_ilm_policy"
}
}
else {
elasticsearch {
hosts => ["http://example-host:9200"]
user => "test-user"
password => "test-password"
template_name => "other"
manage_template => true
template => "/etc/logstash/mappings/other.json"
template_overwrite => true
doc_as_upsert => true
document_id => "%{id}"
ilm_enabled => true
ilm_rollover_alias => "other"
ilm_policy => "other_ilm_policy"
}
}
}

Logstash version: 7.0.1 (also tested on 7.6.0 getting the same error)

Error:

[2020-02-20T23:42:38,354][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"undefined method update' for nil:NilClass", :class=>"NoMethodError", :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.0.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:39:in add_ilm_settings_to_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.0.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:14:in install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.0.2-java/lib/logstash/outputs/elasticsearch/common.rb:129:in install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.0.2-java/lib/logstash/outputs/elasticsearch/common.rb:50:in `block in setup_after_successful_connection'"]}

The first output (auth) works fine, the template and ILM are managed properly. The second output (other) the template is not managed and ILM is not setup properly as well.