Index Template vs Logstash Managed Template

Elastic Stack Elasticsearch
1

Is there any downside to using logstash managed template vs elasticsearch index template? The output for logstash looks like %{type}-%{+YYYY.MM.dd}, so I'm not sure if logstash mapped template can even be like %{type}.json.

Reason I'd prefer it through logstash is it's easier to manage that through puppet than posting into ES which is kind of stateful

2

Btw in ES 2.0 is config/templates no longer a thing? I see it missing in docs https://www.elastic.co/guide/en/elasticsearch/reference/2.0/indices-templates.html vs https://www.elastic.co/guide/en/elasticsearch/reference/1.5/indices-templates.html

3

It ends up being the same unless I'm missing your question.
So no downside IMO. LS will PUT the template for you.

4

What I'm not sure is when does logtash send the PUT request? i.e. does it send the PUT request per bulk or what?

Secondly can you clarify re the templates directory being deprecated in 2.0?

5

Logstash checks when it starts the elasticsearch output that the template exists or not in elasticsearch. If not, it sends the template using PUT _template API.

1 Like
6

tyvm.

7

Actually sorry just though - if I point to templates.json and so templates are approrpriately created, if I update that file, will logstash see the file is updated and PUT the template again? Or does it only check by name basically?

8

It only checks on index creation, so that'll usually be daily.

9

If you need to update that file, then you need to remove the template in elasticsearch and restart logstash.

Logstash elasticsearch output will then restart, will try to check if the template exists and then will put the new template.

I don't think there is a "force put template" option in logstash output but you'd better ask that question in the logstash group :stuck_out_tongue:

10

You and Mark seem to have differing answers. Could one of you clarify who is correct?

11

David is right, it checks on index creation but it does that based on the template that is in ES.

I think LS checks the file each time it starts though.