# Excluding an indice in mapping template

**URL:** https://discuss.elastic.co/t/excluding-an-indice-in-mapping-template/119707
**Category:** Elasticsearch
**Created:** [February 13, 2018, 8:46pm UTC](https://discuss.elastic.co/t/excluding-an-indice-in-mapping-template/119707 "2018-02-13T20:46:39Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![cappy](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@cappy](https://discuss.elastic.co/u/cappy)
#### Post date: [February 13, 2018, 8:46pm UTC](https://discuss.elastic.co/t/excluding-an-indice-in-mapping-template/119707/1 "2018-02-13T20:46:39Z")

</div>

Hi, I was wondering if there was a way to exclude an indice from using a mapping template?

For example, I have the following indices:

logstash-firewall-%{DATE}  
logstash-beats-%{DATE}  
logstash-syslog-%{DATE}

I want to map for `logstash-firewall` and `logstash-syslog`, but not for `logstash-beats` -- I have a separate template for that. My problem is that if I try to use something like `logstash-*` for the index\_pattern for the non-beats indices, and I try to match on the beats indice with an index\_pattern of `logstash-beats-*`, the mappings will be merged. I've tried using `order`, but that doesn't seem to help.

In the end, my goal is to have the template for `logstash-beats` to override any mapping for `logstash-*`.

Any advice would be appreciated.

Thanks,  
Cappy

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 13, 2018, 9:50pm UTC](https://discuss.elastic.co/t/excluding-an-indice-in-mapping-template/119707/2 "2018-02-13T21:50:45Z")

</div>

> [@cappy](#):
>
> In the end, my goal is to have the template for logstash-beats to override any mapping for logstash-\*.

The default behaviour is for more specific mappings to over ride more generic ones.

In this case what you are looking for should be happening without you needing to do anything.

---

<div class="post-metadata">

### Author: ![cappy](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@cappy](https://discuss.elastic.co/u/cappy)
#### Post date: [February 14, 2018, 4:21am UTC](https://discuss.elastic.co/t/excluding-an-indice-in-mapping-template/119707/3 "2018-02-14T04:21:27Z")

</div>

I don't think I'm looking for more specific mappings, I'm looking for those mappings to not get carried over at all. I'm trying to stay under the total field limit for the beats index (not interested in increasing it), and it makes it difficult when the beats index is absorbing all the mappings from `logstash-*` instead of `logstash-beats-*` only mappings.

Cappy

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 18, 2018, 9:26pm UTC](https://discuss.elastic.co/t/excluding-an-indice-in-mapping-template/119707/4 "2018-02-18T21:26:59Z")

</div>

Ahh yeah ok.

You could use priority to balance that out.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 18, 2018, 9:27pm UTC](https://discuss.elastic.co/t/excluding-an-indice-in-mapping-template/119707/5 "2018-03-18T21:27:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
