Index Template vs Logstash Managed Template


(Ashwin Amit) #1

Is there any downside to using logstash managed template vs elasticsearch index template? The output for logstash looks like %{type}-%{+YYYY.MM.dd}, so I'm not sure if logstash mapped template can even be like %{type}.json.

Reason I'd prefer it through logstash is it's easier to manage that through puppet than posting into ES which is kind of stateful


(Ashwin Amit) #2

Btw in ES 2.0 is config/templates no longer a thing? I see it missing in docs https://www.elastic.co/guide/en/elasticsearch/reference/2.0/indices-templates.html vs https://www.elastic.co/guide/en/elasticsearch/reference/1.5/indices-templates.html


(David Pilato) #3

It ends up being the same unless I'm missing your question.
So no downside IMO. LS will PUT the template for you.


(Ashwin Amit) #4

What I'm not sure is when does logtash send the PUT request? i.e. does it send the PUT request per bulk or what?

Secondly can you clarify re the templates directory being deprecated in 2.0?


(David Pilato) #5

Logstash checks when it starts the elasticsearch output that the template exists or not in elasticsearch. If not, it sends the template using PUT _template API.


(Ashwin Amit) #6

tyvm.


(Ashwin Amit) #7

Actually sorry just though - if I point to templates.json and so templates are approrpriately created, if I update that file, will logstash see the file is updated and PUT the template again? Or does it only check by name basically?


(Mark Walkom) #8

It only checks on index creation, so that'll usually be daily.


(David Pilato) #9

If you need to update that file, then you need to remove the template in elasticsearch and restart logstash.

Logstash elasticsearch output will then restart, will try to check if the template exists and then will put the new template.

I don't think there is a "force put template" option in logstash output but you'd better ask that question in the logstash group :stuck_out_tongue:


(Ashwin Amit) #10

You and Mark seem to have differing answers. Could one of you clarify who is correct?


(Mark Walkom) #11

David is right, it checks on index creation but it does that based on the template that is in ES.

I think LS checks the file each time it starts though.


(system) #12