Thanks Rahul.
I made the changes in template to array format , even then the _cat/templates shows index pattern to the default value logstash-*.
As per Logstash 7.0 does ignore index_patterns / template fields in template and overrules that with "logstash-*", seems there to be a bug in logstash 7.0. So have added ilm_enabled => false in my logstash output.
output {
elasticsearch {
hosts => ["localhost:61000"]
index => "%{capability}_%{+YYYY_ww}"
ilm_enabled => false
manage_template => true
template => '/config/etc/logstash/templates/increased_field_limit.json'
template_name => 'increased_field_limit'
template_overwrite => true
}
}
Post the above changes, in _cat/templates I am able to see the index pattern has been updated and matching with the index names too. But still I am receiving the error "reason"=>"Limit of total fields [1000] in index [XXXXX] has been exceeded"
Is it being caused by ilm_enabled => false or anything else to be checked?
Or a version upgrade would solve the issue?
Or should I reindex?
Any help much appreciated please.
Cheers,
Maadavan