# Index Templates... where do they come from?
**URL:** https://discuss.elastic.co/t/index-templates-where-do-they-come-from/184401
**Category:** Elasticsearch
**Created:** [June 5, 2019, 3:01pm UTC](https://discuss.elastic.co/t/index-templates-where-do-they-come-from/184401 "2019-06-05T15:01:07Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@eskorte](https://discuss.elastic.co/u/eskorte)
#### Post date: [June 5, 2019, 3:01pm UTC](https://discuss.elastic.co/t/index-templates-where-do-they-come-from/184401/1 "2019-06-05T15:01:07Z")
Hello!
I see three index templates _filebeat-6.7.1_, _filebeat-7.0.0_ and _filebeat-7.0.1_. Each with corresponding index patterns like _filebeat-7.0.1-_ \*.
Until now my logstash config was set to output.elasticsearch.index =\> **filebeat-%{+yyyy.MM.dd}** - so the templates did not match. Now I set the index to **filebeat-%{[agent][version]}-%{+yyyy.MM.dd}**. But now I use version 7.1.0 and new indexes are called like **filebeat-7.1.0-2019.06.05**. There is no template for this version. So my question is: where does these templates come from, and how do I get one for version 7.1.0?
Best regards,
Sebastian
---
### Author:  [@eskorte](https://discuss.elastic.co/u/eskorte)
#### Post date: [June 6, 2019, 8:27am UTC](https://discuss.elastic.co/t/index-templates-where-do-they-come-from/184401/2 "2019-06-06T08:27:32Z")
Found it, filebeat setup:
```
# filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]' -E "output.elasticsearch.user=elastic" -E "output.elasticsearch.password=xxx"
Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://localhost:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [] for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"unable to authenticate user [] for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}]
```
I wonder why its "Unauthorized"...
---
### Author:  [@eskorte](https://discuss.elastic.co/u/eskorte)
#### Post date: [June 6, 2019, 8:52am UTC](https://discuss.elastic.co/t/index-templates-where-do-they-come-from/184401/3 "2019-06-06T08:52:01Z")
Done. Workaround:
```
# filebeat export template > filebeat.template.json
# curl -XPUT -u "elastic:xxx" -H 'Content-Type: application/json' http://localhost:9200/_template/filebeat-7.1.0 -d@filebeat.template.json
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 4, 2019, 8:52am UTC](https://discuss.elastic.co/t/index-templates-where-do-they-come-from/184401/4 "2019-07-04T08:52:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.