Logstash: 6.5.4
Index template:
{
"_rev": "$Rev: 902 $",
"_comment": "Copyright © 2018, CCG, All rights reserved. ",
"order": 0,
"index_patterns": ["ossec-alerts-*"],
"settings": {
"index" : {
"number_of_shards" : 3,
"number_of_replicas" : 2
},
"refresh_interval": "5s",
"index.mapping.ignore_malformed" : true,
"index.codec" : "best_compression"
},
"mappings": {
If I keep the first two line comments inside the template, logstash will report 400 error can not get access to elasticsearch.
[ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Got response code '400' contacting Elasticsearch at URL 'http://127.0.0.1:9200/_template/elastiflow'", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError",
According to the official document, it claims that we can use /**/ to comment info in template
Index templates provide C-style /* */ block comments. Comments are allowed everywhere in the JSON document except before the initial opening curly bracket.
So I added the /* */ pair to the first two lines, but there's still the error, it can not parse the template.
How can I add comments in the index template?