# Index template order fields seems not to work
**URL:** https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778
**Category:** Elasticsearch
**Created:** [April 30, 2021, 1:06pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778 "2021-04-30T13:06:23Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Adriann](https://discuss.elastic.co/u/Adriann)
#### Post date: [April 30, 2021, 1:06pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778/1 "2021-04-30T13:06:23Z")
Hello,
I have few templates each for every index name based on the module name for ilm management.
I notice that after the update to 7.12.1 all my indices have applied templates with order value 10 event though there are other templates with specific index patterns. What do I need to do to allow template filebeat-7.12.1 to exist to match default index patterns and to let specific index patterns matches with specific index template?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 4, 2021, 2:33am UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778/2 "2021-05-04T02:33:55Z")
Are you referring specifically to lifecycle policy that points to `filebeat` in that last image?
---
### Author:  [@Adriann](https://discuss.elastic.co/u/Adriann)
#### Post date: [May 4, 2021, 12:23pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778/3 "2021-05-04T12:23:27Z")
Yes, this is the lifecycle policy that is set up for the default index template pattern and this is the template that is applied to every index even though the merge number is set up to 10 and the other templates with more specific index pattern have set up the merge number to 1.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 5, 2021, 11:49pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778/4 "2021-05-05T23:49:32Z")
Do you mind pulling the actual json for that that template and posting it?
---
### Author:  [@Adriann](https://discuss.elastic.co/u/Adriann)
#### Post date: [May 6, 2021, 7:53am UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778/5 "2021-05-06T07:53:52Z")
Those are the setting of the template. It's a default template exported from filebeat(7.12.1). The only change was the index pattern, merge value, name and ilm policy. I cut the fields because of the letters limit.
> {
> "index": {
> "lifecycle": {
> "name": "filebeat-fortinet\_policy"
> },
> "mapping": {
> "total\_fields": {
> "limit": "10000"
> }
> },
> "refresh\_interval": "5s",
> "number\_of\_shards": "1",
> "final\_pipeline": "fortinet-default-pipeline",
> "max\_docvalue\_fields\_search": "200",
> "query": {
> "default\_field": [
> "message",
> "tags",
> "agent.ephemeral\_id",
> "agent.id",
> "agent.name",
> "agent.type",
> "agent.version",
> "as.organization.name",
> "client.address",
> "client.as.organization.name",
> "client.domain",
> "client.geo.city\_name",
> "client.geo.continent\_name",
> "client.geo.country\_iso\_code",
> "client.geo.country\_name",
> "client.geo.name",
> "client.geo.region\_iso\_code",
> "client.geo.region\_name",
> "client.mac",
> "client.registered\_domain",
> "client.top\_level\_domain",
> "client.user.domain",
> "client.user.email",
> "client.user.full\_name",
> "client.user.group.domain",
> "client.user.group.id",
> "client.user.group.name",
> "client.user.hash",
> "client.user.id",
> "client.user.name",
> "cloud.account.id",
> "cloud.availability\_zone",
> "cloud.instance.id",
> "cloud.instance.name",
> "cloud.machine.type",
> "cloud.provider",
> "cloud.region",
> "container.id",
> "container.image.name",
> "container.image.tag",
> "container.name",
> "container.runtime",
> "destination.address",
> "destination.as.organization.name",
> "destination.domain",
> "destination.geo.city\_name",
> "destination.geo.continent\_name",
> "destination.geo.country\_iso\_code",
> "destination.geo.country\_name",
> "destination.geo.name",
> "destination.geo.region\_iso\_code",
> "destination.geo.region\_name",
> "destination.mac",
> "destination.registered\_domain",
> "destination.top\_level\_domain",
> "destination.user.domain",
> "destination.user.email",
> "destination.user.full\_name",
> "destination.user.group.domain",
> "destination.user.group.id",
> "destination.user.group.name",
> "destination.user.hash",
> "destination.user.id",
> "destination.user.name",
> "dns.answers.class",
> "dns.answers.data",
> "dns.answers.name",
> "dns.answers.type",
> "dns.header\_flags",
> "dns.id",
> "dns.op\_code",
> "dns.question.class",
> "dns.question.name",
> "dns.question.registered\_domain",
> "dns.question.subdomain",
> "dns.question.top\_level\_domain",
> "dns.question.type",
> "dns.response\_code",
> "dns.type",
> "ecs.version",
> "error.code",
> "error.id",
> "error.message",
> "error.type",
> "event.action",
> "event.category",
> "event.code",
> "event.dataset",
> "event.hash",
> "event.id",
> "event.kind",
> "event.module",
> "event.outcome",
> "event.provider",
> "event.timezone",
> "event.type",
> "file.device",
> "file.directory",
> "file.extension",
> "file.gid",
> "file.group",
> "file.hash.md5",
> "file.hash.sha1",
> "file.hash.sha256",
> "file.hash.sha512",
> "file.inode",
> "file.mode",
> "file.name",
> "file.owner",
> "file.path",
> "file.target\_path",
> "file.type",
> "file.uid",
> "geo.city\_name",
> "geo.continent\_name",
> "geo.country\_iso\_code",
> "geo.country\_name",
> "geo.name",
> "geo.region\_iso\_code",
> "geo.region\_name",
> "group.domain",
> "group.id",
> "group.name",
> "hash.md5",
> "hash.sha1",
> "hash.sha256",
> "hash.sha512",
> "host.architecture",
> "host.geo.city\_name",
> "host.geo.continent\_name",
> "host.geo.country\_iso\_code",
> "host.geo.country\_name",
> "host.geo.name",
> "host.geo.region\_iso\_code",
> "host.geo.region\_name",
> "host.hostname",
> "host.id",
> "host.mac",
> "host.name",
> "host.os.family",
> "host.os.full",
> "host.os.kernel",
> "host.os.name",
> "host.os.platform",
> "host.os.version",
> "host.type",
> "host.user.domain",
> "host.user.email",
> "host.user.full\_name",
> "host.user.group.domain",
> "host.user.group.id",
> "host.user.group.name",
> "host.user.hash",
> "host.user.id",
> "host.user.name",
> "http.request.body.content",
> "http.request.method",
> "http.request.referrer",
> "http.response.body.content",
> "http.version",
> "log.level",
> "log.logger",
> "log.origin.file.name",
> "log.origin.function",
> "log.syslog.facility.name",
> "log.syslog.severity.name",
> "network.application",
> "network.community\_id",
> "network.direction",
> "network.iana\_number",
> "network.name",
> "network.protocol",
> "network.transport",
> "network.type",
> "observer.geo.city\_name",
> "observer.geo.continent\_name",
> "observer.geo.country\_iso\_code",
> "observer.geo.country\_name",
> "observer.geo.name",
> "observer.geo.region\_iso\_code",
> "observer.geo.region\_name",
> "observer.hostname",
> "observer.mac",
> "observer.name",
> "observer.os.family",
> "observer.os.full",
> "observer.os.kernel",
> "observer.os.name",
> "observer.os.platform",
> "observer.os.version",
> "observer.product",
> "observer.serial\_number",
> "observer.type",
> "observer.vendor",
> "observer.version",
> "organization.id",
> "organization.name",
> "os.family",
> "os.full",
> "os.kernel",
> "os.name",
> "os.platform",
> "os.version",
> "package.architecture",
> "package.checksum",
> "package.description",
> "package.install\_scope",
> "package.license",
> "package.name",
> "package.path",
> "package.version",
> "process.args",
> "text",
> "process.executable",
> "process.hash.md5",
> "process.hash.sha1",
> "process.hash.sha256",
> "process.hash.sha512",
> "process.name",
> "text",
> "text",
> "text",
> "text",
> "text",
> "process.thread.name",
> "process.title",
> "process.working\_directory",
> "server.address",
> "server.as.organization.name",
> "server.domain",
> "server.geo.city\_name",
> "server.geo.continent\_name",
> "server.geo.country\_iso\_code",
> "server.geo.country\_name",
> "server.geo.name",
> "server.geo.region\_iso\_code",
> "server.geo.region\_name",
> "server.mac",
> "server.registered\_domain",
> "server.top\_level\_domain",
> "server.user.domain",
> "server.user.email",
> "server.user.full\_name",
> "server.user.group.domain",
> "server.user.group.id",
> "server.user.group.name",
> "server.user.hash",
> "server.user.id",
> "server.user.name",
> "service.ephemeral\_id",
> "service.id",
> "service.name",
> "service.node.name",
> "service.state",
> "service.type",
> "service.version",
> "source.address",
> "source.as.organization.name",
> "source.domain",
> "source.geo.city\_name",
> "source.geo.continent\_name",
> "source.geo.country\_iso\_code",
> "source.geo.country\_name",
> "source.geo.name",
> "source.geo.region\_iso\_code",
> "source.geo.region\_name",
> "source.mac",
> "source.registered\_domain",
> "source.top\_level\_domain",
> "source.user.domain",
> "source.user.email",
> "source.user.full\_name",
> "source.user.group.domain",
> "source.user.group.id",
> "source.user.group.name",
> "source.user.hash",
> "source.user.id",
> "source.user.name",
> "threat.framework",
> "threat.tactic.id",
> "threat.tactic.name",
> "threat.tactic.reference",
> "threat.technique.id",
> "threat.technique.name",
> "threat.technique.reference",
> "text",
> "trace.id",
> "transaction.id",
> "url.domain",
> "url.extension",
> "url.fragment",
> "url.full",
> "url.original",
> "url.password",
> "url.path",
> "url.query",
> "url.registered\_domain",
> "url.scheme",
> "url.top\_level\_domain",
> "url.username",
> "text",
> "text",
> "user.domain",
> "text",
> "text",
> "user.email",
> "user.full\_name",
> "user.group.domain",
> "user.group.id",
> "user.group.name",
> "user.hash",
> "user.id",
> "user.name",
> "text",
> "text",
> "user\_agent.device.name",
> "user\_agent.name",
> "text",
> "user\_agent.original",
> "user\_agent.os.family",
> "user\_agent.os.full",
> "user\_agent.os.kernel",
> "user\_agent.os.name",
> "user\_agent.os.platform",
> "user\_agent.os.version",
> "user\_agent.version",
> "text",
> "agent.hostname",
> "timeseries.instance",
> "cloud.image.id",
> "host.os.build",
> "host.os.codename",
> "kubernetes.pod.name",
> "kubernetes.pod.uid",
> "kubernetes.namespace",
> "kubernetes.node.name",
> "kubernetes.node.hostname",
> "kubernetes.replicaset.name",
> "kubernetes.deployment.name",
> "kubernetes.statefulset.name",
> "kubernetes.container.name",
> "kubernetes.container.image",
> "jolokia.agent.version",
> "jolokia.agent.id",
> "jolokia.server.product",
> "jolokia.server.version",
> "jolokia.server.vendor",
> "jolokia.url",
> "log.source.address",
> "stream",
> "input.type",
> "syslog.severity\_label",
> "syslog.facility\_label",
> "process.program",
> "log.flags",
> "user\_agent.os.full\_name",
> "fileset.name",
> "icmp.code",
> "icmp.type",
> "igmp.type",
> "azure.eventhub",
> "azure.consumer\_group",
> "kafka.topic",
> "kafka.key",
> "activemq.caller",
> "activemq.thread",
> "activemq.user",
> "activemq.log.stack\_trace",
> "apache.access.ssl.protocol",
> "apache.access.ssl.cipher",
> "apache.error.module",
> "user.terminal",
> "user.audit.id",
> "user.audit.name",
> "user.audit.group.id",
> "user.audit.group.name",
> "user.filesystem.id",
> "user.filesystem.name",
> "user.saved.id",
> "user.saved.name",
> "user.saved.group.id",
> "user.saved.group.name",
> "auditd.log.old\_auid",
> "auditd.log.new\_auid",
> "auditd.log.old\_ses",
> "auditd.log.new\_ses",
> "auditd.log.items",
> "auditd.log.item",
> "auditd.log.tty",
> "auditd.log.a0",
> "bucket\_name",
> "object\_key",
> "azure.subscription\_id",
> "azure.correlation\_id",
> "azure.tenant\_id",
> "zeek.notice.sub",
> "zeek.notice.peer\_name",
> "zeek.notice.peer\_descr",
> "zeek.notice.actions",
> "zeek.notice.email\_body\_sections",
> "zeek.notice.email\_delay\_tokens",
> "zeek.notice.identifier",
> "fields.\*"
> ]
> },
> "number\_of\_replicas": "0"
> }
> }
---
### Author:  [@Adriann](https://discuss.elastic.co/u/Adriann)
#### Post date: [May 6, 2021, 5:48pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778/6 "2021-05-06T17:48:44Z")
When I deleted the template filebeat-7.12.1(red underline) no new index could be created because the filebeat user does not have the right to put new templates. While no new logs could be index I could see in filebeat logs
I have no idea who these index patterns do not want to work.
---
### Author:  [@Adriann](https://discuss.elastic.co/u/Adriann)
#### Post date: [May 6, 2021, 6:07pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778/7 "2021-05-06T18:07:33Z")
I have the answer. It was the "." in the pattern. After changing to template index pattern from `" filebeat-7.12.1-system-*"` to `"filebeat-*-system-*"` It started to work properly.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 3, 2021, 6:08pm UTC](https://discuss.elastic.co/t/index-template-order-fields-seems-not-to-work/271778/8 "2021-06-03T18:08:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.