File template overriding not working

Hi,

I 've change default filebeat-template to make "message" property type as "object".
But not shown as "object" in index. Shown as default "string".

Log says;
"2016/11/21 15:43:30.532659 output.go:164: INFO Loading template enabled. Trying to load template: /etc/filebeat/filebeat.template.json
2016/11/21 15:43:30.595836 output.go:172: INFO Existing template will be overwritten, as overwrite is enabled.
2016/11/21 15:43:30.919118 client.go:266: INFO Elasticsearch template with name 'filebeat' loaded"

Any idea?

# cat /etc/filebeat/filebeat.template.json
{
"mappings": {
"default": {
"_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "not_analyzed",
"type": "{dynamic_type}"
},
"match": ""
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"message": {
"type": "object"
},
"offset": {
"type": "long",
"doc_values": "true"
}
}
}
},
"settings": {
"index.refresh_interval": "5s"
},
"template": "filebeat-
"
}

# cat /etc/filebeat/filebeat.yml | grep template: -A 10
template:

Template name. By default the template name is filebeat.

name: "filebeat"

Path to template file

path: "/etc/filebeat/filebeat.template.json"

Overwrite existing template

overwrite: true

I found the issue.
in last line of template file, template propery value did not matching with my index name.
thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.