File template overriding not working

Elastic Stack Beats
1

Hi,

I 've change default filebeat-template to make "message" property type as "object".
But not shown as "object" in index. Shown as default "string".

Log says;
"2016/11/21 15:43:30.532659 output.go:164: INFO Loading template enabled. Trying to load template: /etc/filebeat/filebeat.template.json
2016/11/21 15:43:30.595836 output.go:172: INFO Existing template will be overwritten, as overwrite is enabled.
2016/11/21 15:43:30.919118 client.go:266: INFO Elasticsearch template with name 'filebeat' loaded"

Any idea?

# cat /etc/filebeat/filebeat.template.json
{
"mappings": {
"default": {
"_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "not_analyzed",
"type": "{dynamic_type}"
},
"match": ""
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"message": {
"type": "object"
},
"offset": {
"type": "long",
"doc_values": "true"
}
}
}
},
"settings": {
"index.refresh_interval": "5s"
},
"template": "filebeat-"
}

# cat /etc/filebeat/filebeat.yml | grep template: -A 10
template:

Template name. By default the template name is filebeat.

name: "filebeat"

Path to template file

path: "/etc/filebeat/filebeat.template.json"

Overwrite existing template

overwrite: true

2

I found the issue.
in last line of template file, template propery value did not matching with my index name.
thanks.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.