[es7.6.2][logstash7.6.2]Why logstash maps to the default index template when the index name not match the index_patterns?

Elastic Stack Logstash
1

Hi Team,

When starting logstash, I see below log which means that my data will be indexed according to default template structure.

 [2020-04-16T13:05:48,661][INFO ]    [logstash.outputs.elasticsearch][main] Using default mapping template
    [2020-04-16T13:05:48,718][INFO ][logstash.outputs.elasticsearch][main] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}

What confuse me is that the conditions to match the default template is that index name must start with "logstash-", but the index name I defined in logstash.conf is "uba", which means that it's impossible match to the default template. Anyone know what's the reason

output {
elasticsearch {
action => "index"
hosts => ["http://localhost:9200"]
index => "uba" }
stdout { codec => rubydebug {metadata => true}}
}

2

No, it doesn't. It means the elasticsearch output has installed a default template which applies to indexes that match the logstash-* pattern. Yours does not, so it will not apply.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.