Index not getting created in elasticsearch hot node

Below is the elasticsearch output plugin in logstash

 output {
            elasticsearch {
                     hosts => [""]
                      index => "test-axiom"
                   #  ilm_rollover_alias => "hub-axiom-new"
                   #  ilm_pattern => "{now/d}-000001"
                   #  ilm_policy => "axiom5-new"
                     document_id => "%{unqid}"
                     template => "/etc/logstash/templatehot/logstash-test.json"
                     user => "adfad"
                     password => "dnjvafaj"
                     ssl => true
                     ssl_certificate_verification => false
                     cacert => "/etc/logstash/ca.crt"


This is the template i am using so that the index gets created in hot node
"index_patterns": ["test-ax*"],
"settings": {
"number_of_shards": 1,
"number_of_replicas": 0,

the index is getting created in warm node instead

test-axiom 0 p STARTED 32625 64.6mb data-warm-3
test-axiom 0 r STARTED 32625   65mb data-warm-1

Could you run:

GET /_template/
GET /test-axiom

I can see that you have also one replica which means that the template is not used or is not the one you think.

Yes @dadoonet the template does not exist when i run this GET /_template/ but i am applying the correct template i have checked it several times

elasticsearch - Attempting to install template {:manage_template=>{"index_patterns"=>["test-ax*"], "settings"=>{"number_of_shards"=>1, "number_of_replicas"=>0, ""=>"hot"}}}

Also i am getting the above log from logstash which implicates its attempting to install template

Could you try to install the template manually from Kibana dev console to see if there is any problem?

The template name by default is logstash. See
You might have to set template_overwrite.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.