# Index issues

**URL:** https://discuss.elastic.co/t/index-issues/195585
**Category:** Beats
**Tags:** filebeat
**Created:** [August 17, 2019, 6:03am UTC](https://discuss.elastic.co/t/index-issues/195585 "2019-08-17T06:03:09Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)
#### Post date: [August 17, 2019, 6:03am UTC](https://discuss.elastic.co/t/index-issues/195585/1 "2019-08-17T06:03:10Z")

</div>

Hello

I have setup a template  
`PUT /_template/active-directory`

I have setup an index  
`PUT active-directory`

When i confirm my mappings, they are as expected. They just include the mappings i have specifically set.  
`GET active-directory/_mapping`

When i ingest data with Filebeat, the template seems to be overwritten and all the default Filebeat ECS fields are added to my mappings.

Here is filebeat.yml

```
setup.ilm.enabled: auto
setup.ilm.policy_name: "active-directory"
setup.ilm.rollover_alias: "active-directory"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.overwrite: false
setup.template.name: "active-directory"
setup.template.pattern: active-directory-*
setup.template.overwrite: false

```

here is the template

```
PUT /_template/active-directory
{
	"order" : 1,
    "index_patterns" : [
      "active-directory"
    ],
  "settings": {
		"index": {
			"lifecycle": {
				"name": "active-directory",
				"rollover_alias": "active-directory"
			}
    },
    "mapping" : {
          "total_fields" : {
            "limit" : "10000"
          }
        }
	},
	"mappings": {
		"properties": {
			"@timestamp": {
				"type": "date"
			},
			"ad": {
				"properties": {
					"distinguishedname": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"enabled": {
						"type": "boolean"
					},
					"objectclass": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"objectguid": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"samaccountname": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"samaccounttype": {
						"type": "long"
					},
					"primarygroupid": {
						"type": "long"
					},
					"primarygroup": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"protectedfromaccidentaldeletion": {
						"type": "boolean"
					},
					"passwordexpired": {
						"type": "boolean"
					},
					"passwordneverexpires": {
						"type": "boolean"
					},
					"passwordnotrequired": {
						"type": "boolean"
					},
					"sid": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"name": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"userprincipalname": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"memberof": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"iscriticalsystemobject": {
						"type": "boolean"
					},
					"ipv4address": {
						"type": "ip"
					},
					"instancetype": {
						"type": "long"
					},
					"canonicalname": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"admincount": {
						"type": "long"
					},
					"allowreversiblepasswordencryption": {
						"type": "boolean"
					},
					"operatingsystem": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"operatingsystemhotfix": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"operatingsystemservicepack": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"operatingsystemversion": {
						"ignore_above": 1024,
						"type": "keyword"
					},
					"whencreated": {
					  "format": "yyyy-MM-dd HH:mm:ss",
						"type": "date"
					},
					"whenchanged": {
					  "format": "yyyy-MM-dd HH:mm:ss",
						"type": "date"
					},
					"pwdlastset": {
					  "format": "yyyy-MM-dd HH:mm:ss",
						"type": "date"
					}
				}
			}
		}
	}
}
```

---

<div class="post-metadata">

### Author: ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [August 20, 2019, 7:45pm UTC](https://discuss.elastic.co/t/index-issues/195585/2 "2019-08-20T19:45:58Z")

</div>

So your goal is to have only the fields you include in your custom template, and not include other filebeat fields in the index template?

I'm not completely clear on the order things are happening, but one thing I notice is that your template has `index_patterns` set to `"active-directory"` when you probably meant `"active-directory-*"`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 17, 2019, 7:56pm UTC](https://discuss.elastic.co/t/index-issues/195585/3 "2019-09-17T19:56:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.