# From filebeat.template.json to fields.yml
**URL:** https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791
**Category:** Beats
**Tags:** filebeat
**Created:** [May 7, 2018, 7:42am UTC](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791 "2018-05-07T07:42:11Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@\_kyllr](https://discuss.elastic.co/u/_kyllr)
#### Post date: [May 7, 2018, 7:42am UTC](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791/1 "2018-05-07T07:42:11Z")
Hi,
We're about to upgrade filebeat 5.5.2 to filebeat 6.2.2
But then the default index template were changed from .json file to .yml file
My question is, how could I put the below json to yml format for us to be able to have a dynamic templates?
```
"dynamic_templates": [
{
"ipAddress": {
"match": "ipAddress",
"mapping": {
"type": "ip"
}
}
}
]
```
Thank you!
---
### Author:  [@\_kyllr](https://discuss.elastic.co/u/_kyllr)
#### Post date: [May 7, 2018, 11:05am UTC](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791/2 "2018-05-07T11:05:40Z")
According to your documentation:
By default Elasticsearch will map string fields as a text field with a sub keyword field. However if you are only indexing structured content and not interested in full text search, you can make Elasticsearch map your fields only as `keyword`s.
But why am I seeing on my logs is the below dynamic\_templates:
```
"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"ignore_above": 1024,
"type": "keyword"
```
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 8, 2018, 10:49am UTC](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791/3 "2018-05-08T10:49:32Z")
Few things here:
- You can specify a dynamic field by setting the field to `type: object` and then use `object_type: ...` to specify the type. For example:
```auto
- name: fields
type: object
object_type: keyword
description: >
Contains user configurable fields.
```
- The part you have above is a default we have in beats. Not sure if there is a good way to overwrite this. You can always use `filebeat export template` to get the raw template and then load it yourself. We are also planning to make loading from a template available again.
---
### Author:  [@\_kyllr](https://discuss.elastic.co/u/_kyllr)
#### Post date: [May 8, 2018, 11:12am UTC](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791/4 "2018-05-08T11:12:11Z")
Hi ruflin,
That was a great help!
So what if I use filebeat export template, does it mean that it'll also be applied to the future logs or will it still be loaded the default template from filebeat 6.2.2?
Thanks.
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 8, 2018, 11:42am UTC](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791/5 "2018-05-08T11:42:27Z")
If you export the template to a file and load it manually, make sure you disable automatic template loading in your Beat.
To simplify loading a template I just opened [https://github.com/elastic/beats/pull/7039](https://github.com/elastic/beats/pull/7039) It's not done yet, but we get there 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 5, 2018, 11:42am UTC](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791/6 "2018-06-05T11:42:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.