# Index template create problem with logstash 2.1.1

**URL:** <https://discuss.elastic.co/t/index-template-create-problem-with-logstash-2-1-1/41368>\
**Category:** Logstash\
**Created:** [February 10, 2016, 11:14am UTC](https://discuss.elastic.co/t/index-template-create-problem-with-logstash-2-1-1/41368 "2016-02-10T11:14:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![paltryeffort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paltryeffort/32/28717_2.png) [@paltryeffort](https://discuss.elastic.co/u/paltryeffort)\
**Post date:** [February 10, 2016, 11:14am UTC](https://discuss.elastic.co/t/index-template-create-problem-with-logstash-2-1-1/41368/1 "2016-02-10T11:14:51Z")

</div>

I am trying to upgrade from logstash 1.4.2 to logstash 2.1.1 and I have a problem when a new index gets created. I tried to reduce all configs to the minimum and now I have the following:

The most important piece is my index\_template.json:

```
{
  "template" : "logstash-*",
  "settings" : {
    "index.refresh_interval" : "5s",
    "index.number_of_shards" : 5,
    "index.number_of_replicas" : 1
  },
  "mappings" : {
    "_default_" : {
       "_all" : {"enabled" : true},
       "dynamic_templates" : [ {
         "string_fields" : {
           "match" : "*",
           "match_mapping_type" : "string",
           "mapping" : {
             "type" : "string", "index" : "analyzed", "omit_norms" : true,
               "fields" : {
                 "raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
               }
           }
         }
       } ],
       "properties" : {
         "@version": { "type": "string", "index": "not_analyzed" },
         "receive_time" : {
           "type" : "string"
         }
       }
    }
  }
}

```

I am forcing the "receive\_time" to be a string. However with logstash 2.1.1 this field is _sometimes_ a "string" and _sometimes_ a "date"

My logstash config:

```
input {
    file {
        path => "/tmp/logfile"
        sincedb_path => "/tmp/logfile.sincedb"
        start_position => "end"
    }
}
filter {
   mutate {
       #copy timestamp. In the index_template this field is forced to be a "string"
       add_field => ["receive_time", "%{@timestamp}"]
   }
}
output {
        elasticsearch {
          hosts => ["elasticsearch:9200"]
          flush_size => 100
          workers => 2
          template => "index_template.json"
          template_overwrite => true
        }
}

```

How to reproduce:

- install elasticsearch 1.5.1 e.g. "docker pull elasticsearch:1.5.1" and run it
- run logstash 2.1.1 with the above mentioned config and index\_template
- create log entries:  
for i in $(seq 1000); do echo "line number $i"; done \>\>/tmp/logfile

Now check the type of the field "receive\_time". This should be a string.

- stop elasticsearch and delete all data (e.g. remove the container and create a new one)
- repeat creating log entries

Check the type of the field "receive\_time". Now this field is of type "date".

If you do the same steps with logstash 1.4.2 this never happens. Maybe because "receive\_time" is always a string in this version.

Obviously I don't delete all my elasticsearch data daily. In my stage environment this happens when a new index gets created. Sometimes it is a "string" and sometimes it's a "date". In the latter case I get errors in elasticsearch like this:

```
org.elasticsearch.index.mapper.MapperParsingException: failed to parse [receive_time]
Caused by: org.elasticsearch.index.mapper.MapperParsingException: failed to parse date field [2016-02-03 12:40:32 +0100], tried both date format [dateOptionalTime], and timestamp number with locale []
Caused by: java.lang.IllegalArgumentException: Invalid format: "2016-02-03 12:40:32 +0100" is malformed at " 12:40:32 +0100"
```

---

<div class="post-metadata">

**Author:** ![ebuildy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebuildy/32/6070_2.png) [@ebuildy](https://discuss.elastic.co/u/ebuildy)\
**Post date:** [February 10, 2016, 12:23pm UTC](https://discuss.elastic.co/t/index-template-create-problem-with-logstash-2-1-1/41368/2 "2016-02-10T12:23:17Z")

</div>

Can you confirm that the template has been applied to logstash-XXXX index?

You can apply the template manually with elasticsearch API maybe.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/index-template-create-problem-with-logstash-2-1-1/41368/3 "2017-07-06T05:12:16Z")

</div>