# Index template not taking effect on index created

**URL:** https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464
**Category:** Logstash
**Created:** [December 6, 2017, 7:11am UTC](https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464 "2017-12-06T07:11:24Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![pope843](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@pope843](https://discuss.elastic.co/u/pope843)
#### Post date: [December 6, 2017, 7:11am UTC](https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464/1 "2017-12-06T07:11:25Z")

</div>

Hello guys,

i have a problem on my index creation, the i can see that mappings/settings is created based on the template as checked (GET \_template). but the created index doesnt get the mappings/settings when created.

Here is my config for the output

output {  
if [type] == "log" {  
elasticsearch {  
hosts =\> ["awsES:443"]  
sniffing =\> false  
index =\> "em-hlr-applog-%{+YYYY.MM.dd}"  
template =\> "/home/ubuntu/ELK/my-emhlrlog-template-updated.json"  
template\_name =\> "log-_"  
template\_overwrite =\> true  
document\_type =\> "%{[@metadata][type]}"  
}  
}  
else if [type] == "sys" {  
elasticsearch {  
hosts =\> ["awsES:443"]  
sniffing =\> false  
manage\_template =\> false  
index =\> "emhlr-syslog-%{+YYYY.MM.dd}"  
template =\> "/home/ubuntu/ELK/my-syslogtemplate-updated.json"  
template\_name =\> "syslog-_"  
template\_overwrite =\> true  
document\_type =\> "%{[@metadata][type]}"  
}  
}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 8, 2017, 6:23am UTC](https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464/2 "2017-12-08T06:23:52Z")

</div>

And what does the template look like?

---

<div class="post-metadata">

### Author: ![pope843](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@pope843](https://discuss.elastic.co/u/pope843)
#### Post date: [December 8, 2017, 6:29am UTC](https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464/3 "2017-12-08T06:29:56Z")

</div>

Hello Magnus,

Please see below. Index template already take effect. But is it possible to have multiple mappings for different "type" (document\_type in filebeat) on a single template file.

like ex. i have the following "type".

webapplog  
feapplog  
uiapplog  
hlrlog

----template---

{

```
"template": "*applog-*",

"settings": {

    "analysis": {

        "index" : {

            "number_of_shards" : 3,

            "number_of_replicas" : 1

        },

        "analyzer": {

            "domain_name_analyzer": {

                "filter":"lowercase",

                "tokenizer": "domain_name_tokenizer",

                "type": "custom"

            }

        },

        "tokenizer": {

            "domain_name_tokenizer": {

                "type": "PathHierarchy",

                "delimiter": ".",

                "reverse": true

            }

        }

    }

},

"mappings": {

"hlrlog": {

  "properties": {

      "message": {

        "type": "text",

        "fields": {

          "ws": {

            "type": "text",

            "analyzer": "whitespace"

          }

        }

      }

    }

  }

}

```

}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 8, 2017, 6:37am UTC](https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464/4 "2017-12-08T06:37:09Z")

</div>

So what happens if you create an index named e.g. em-hlr-applog-2017.12.31 with a REST call to ES? What mappings does the index get?

> Please see below. Index template already take effect. But is it possible to have multiple mappings for different "type" (document\_type in filebeat) on a single template file.

Yes.

---

<div class="post-metadata">

### Author: ![pope843](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@pope843](https://discuss.elastic.co/u/pope843)
#### Post date: [December 8, 2017, 7:18am UTC](https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464/5 "2017-12-08T07:18:15Z")

</div>

here magnus, you can see i have multiple mappings that should not be included. I've used multiple index template file for each "type".

{  
"em-hlr-applog-2017.12.07" : {  
"aliases" : { },  
"mappings" : {  
"maprouterlog" : {  
"properties" : {  
"message" : {  
"type" : "text",  
"fields" : {  
"ws" : {  
"type" : "text",  
"analyzer" : "whitespace"  
}  
}  
}  
}  
},  
"hlrlog" : {  
"properties" : {  
"%{" : {  
"properties" : {  
"@metadata" : {  
"properties" : {  
"fingerprint" : {  
"properties" : {  
"}" : {  
"type" : "long"  
}  
}  
}  
}  
}  
}  
},  
"@timestamp" : {  
"type" : "date"  
},  
"@version" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"akkatimestamp" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"beat" : {  
"properties" : {  
"hostname" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"name" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"version" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
}  
}  
},  
"dateko" : {  
"type" : "date"  
},  
"host" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"input\_type" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"message" : {  
"type" : "text",  
"fields" : {  
"ws" : {  
"type" : "text",  
"analyzer" : "whitespace"  
}  
}  
},  
"offset" : {  
"type" : "long"  
},  
"received\_at" : {  
"type" : "date"  
},  
"received\_from" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"source" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"tags" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"timestampko" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"type" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
}  
}  
},  
"applog" : {  
"properties" : {  
"message" : {  
"type" : "text",  
"fields" : {  
"ws" : {  
"type" : "text",  
"analyzer" : "whitespace"  
}  
}  
}  
}  
},  
"emggsnlog" : {  
"properties" : {  
"message" : {  
"type" : "text",  
"fields" : {  
"ws" : {  
"type" : "text",  
"analyzer" : "whitespace"  
}  
}  
}  
}  
}  
},  
"settings" : {  
"index" : {  
"number\_of\_shards" : "5",  
"provided\_name" : "em-hlr-applog-2017.12.07",  
"creation\_date" : "1512604806737",  
"analysis" : {  
"index" : {  
"number\_of\_shards" : "3",  
"number\_of\_replicas" : "1"  
},  
"analyzer" : {  
"domain\_name\_analyzer" : {  
"filter" : "lowercase",  
"type" : "custom",  
"tokenizer" : "domain\_name\_tokenizer"  
}  
},  
"tokenizer" : {  
"domain\_name\_tokenizer" : {  
"reverse" : "true",  
"type" : "PathHierarchy",  
"delimiter" : "."  
}  
}  
},  
"number\_of\_replicas" : "1",  
"uuid" : "Ace2Job1RgCc7l8KA8O4Qw",  
"version" : {  
"created" : "5050299"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 8, 2017, 8:27am UTC](https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464/6 "2017-12-08T08:27:00Z")

</div>

> here magnus, you can see i have multiple mappings that should not be included.

But that's not the mappings of an index you've created with a REST call is it? I want to see what it looks like before you start adding documents with Logstash.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 5, 2018, 8:27am UTC](https://discuss.elastic.co/t/index-template-not-taking-effect-on-index-created/110464/7 "2018-01-05T08:27:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
