I tried Installing filebeat 7.14 in kubernetes on a new elastic cluster. In the old cluster I had over 5000 fields in the filebeat index pattern, which made it impossible to add new fields. In the new index in the new cluster, with very little data, we found there are over 6300 fields when we created the index pattern.
The documentation mentions that you can use different settings for template.type
setup.template.type
The type of template to use. Available options: legacy (default), index templates before Elasticsearch v7.8. Use this to avoid breaking existing deployments. New options are component and index. Selecting component loads a component template which can be included in new index templates. The option index loads the new index template.
But there is no mention of what this means? What is a legacy template? What is a "component template"? And what does template type "index" mean? I am confused.
There are two types of templates: index templates and component templates. Component templates are reusable building blocks that configure mappings, settings, and aliases. While you can use component templates to construct index templates, they aren’t directly applied to a set of indices. Index templates can contain a collection of component templates, as well as directly specify settings, mappings, and aliases.
Basically I can use a different combination of component templates to build a new index template. This allows greater flexibility since you can just reuse the same configuration in different index template without having to rewrite everything while creating a new index template.
The concept of "component templates" was only introduced in version 7.8. So if you are using an older deployment, you need to load the legacy index template.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.