Good practice for index templates in ES

Elastic Stack Elasticsearch
6

Remember that you can order index templates, allowing you to create a general low-order template to be used for all your indices and then higher order templates with more specialized mappings.

With your two different indices you could create three index templates with slightly different mappings - one general with all the common fields and two smaller templates with the fields unique to each index. For instance like this (assuming you're on ES7):

PUT /_template/ab_general
{
    "index_patterns" : ["ab*"],
    "order" : 0,
    "mappings" : {
         "field1": {
               "type": "text"
         },
         "field2" : {
               "type": "text"
         },
         "field4" : {
               "ignore_above": 256, 
               "type": "keyword"
         }
    }
}

This order 0 template will be applied to all new indices created with a name starting with "ab".

To specify the unique fields, simply create two order 1 templates with the desired mappings:

PUT /_template/abde
{
    "index_patterns" : ["abde*"],
    "order" : 1,
    "mappings" : {
         "field3" : {
               "ignore_above": 256, 
               "type": "keyword"
         }
    }
}

and

PUT /_template/abcd
{
    "index_patterns" : ["abcd*"],
    "order" : 1,
    "mappings" : {
         "field5" : {
               "ignore_above": 256, 
               "type": "keyword"
         }
    }
}

Since the index_patterns are different the last two can't both be applied to the same index, either the first one will match, when you create the "abde" index, or the latter will when you create "abcd". In both cases the order 0 template will also match and be applied first (as an order 0 template should) giving you the desired mapping for each of your indices.

The index template mechanism is very useful for "inheriting" fields or overriding defaults with more specialized mappings. I commonly use 3-4 templates in my clusters with all the general mappings in the order 0 template and then increasingly more specialized mappings in higher order templates. This makes it easy for me to maintain all my mappings and to extend them to support new types of indices.