Excluding an indice in mapping template

Elastic Stack Elasticsearch
1

Hi, I was wondering if there was a way to exclude an indice from using a mapping template?

For example, I have the following indices:

logstash-firewall-%{DATE}
logstash-beats-%{DATE}
logstash-syslog-%{DATE}

I want to map for logstash-firewall and logstash-syslog, but not for logstash-beats -- I have a separate template for that. My problem is that if I try to use something like logstash-* for the index_pattern for the non-beats indices, and I try to match on the beats indice with an index_pattern of logstash-beats-*, the mappings will be merged. I've tried using order, but that doesn't seem to help.

In the end, my goal is to have the template for logstash-beats to override any mapping for logstash-*.

Any advice would be appreciated.

Thanks,
Cappy

2

The default behaviour is for more specific mappings to over ride more generic ones.

In this case what you are looking for should be happening without you needing to do anything.

3

I don't think I'm looking for more specific mappings, I'm looking for those mappings to not get carried over at all. I'm trying to stay under the total field limit for the beats index (not interested in increasing it), and it makes it difficult when the beats index is absorbing all the mappings from logstash-* instead of logstash-beats-* only mappings.

Cappy

4

Ahh yeah ok.

You could use priority to balance that out.