How do I update a index template?

Elastic Stack Elasticsearch
1

I'm currently using a modified index template for filebeat. I have data ingesting with the indexs rolling daily based on data. The fields are coming from logstash grok. I want to parse some additional fields and want that field to be indexed. If I try to post the template via curl it says template already exists. I'm fine if old logs don't have that index but I would like the newly created indexes to use an updated template (i.e. I've added a new field called field.environment).

Do I need to just delete the existing template and add the new template and elasticsearch will pick it up when it rolls over to the next day or is there something else I need to do?

2

A put request should work to update template, note template is applied at index creation so wont affect existing indices
https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

3

That's fine. I'm assuming it will create a new index on the next day correct, in that if I updated the template that field should be in the index on the next day?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.