How to change "ignore_above" property of field in index pattern even index match pattern will be insert in the future?

[le_ba_nam]

I want to change "ignore_above" property of field in index pattern. I have success with post request like:

PUT myIndex-*/doc/_mapping
{
    "properties": {
        "message": {
            "type": "text",
            "norms": false,
            "fields": {
                "keyword": {
                    "type": "keyword",
                    "ignore_above": 2000
                }
            }
        }
    }
}

But it can not set to index which match to this pattern will be inserted in the future, just set to exist index in present. How to set for future index? Thanks

[Wolfram_Haussig]

Hi,

This is where Index Templates can be used.
Basically, you define on which indexes the template should be applied and Elasticsearch will copy settings, mapping and so on to each new index which matches the index name pattern.

Best regards
Wolfram

[le_ba_nam]

Thanks for reply. Im search google for it but still confuse about how to view what template was applied on my index pattern and, if I can get it, is it have API to update that template?

[Wolfram_Haussig]

Depending on the Stack version you can either use the ElasticSearch API (GET _template)
or the Kibana menu entry(Stack Management -> Data -> Index Management -> Index Templates) to list which templates exist and which indexes are affected.

The same is true for creating a template: either use the API or Kibana

[le_ba_nam]

I wonder whether I can create new index template for index pattern just for one field I want to change its property and not affect on others? Just add, not replace.

Particularly, I want to change "ignore_above" property of message field from 256 to 2000. Is 256 set by built-in template of Elasticsearch and have priority value equal 100. In such case, whether I have to create new template with higher priority?

Because Elasticsearch server used by my team, I want to sure about that. Thanks.

[Wolfram_Haussig]

Currently, Index templates are additive - so creating an index template for this index pattern with a single field mapping will affect only this index while other index templates can still be applied.