# Load new template - Error 400 **URL:** \ **Category:** Logstash\ **Created:** [May 3, 2018, 8:37am UTC](https://discuss.elastic.co/t/load-new-template-error-400/130402 "2018-05-03T08:37:21Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![giuliano](https://avatars.discourse-cdn.com/v4/letter/g/ec9cab/32.png) [@giuliano](https://discuss.elastic.co/u/giuliano)\ **Post date:** [May 3, 2018, 8:37am UTC](https://discuss.elastic.co/t/load-new-template-error-400/130402/1 "2018-05-03T08:37:21Z")
Hi all, I use ELK 6.2.4 and I want to load a new template from the output section because I have change the "target" value in the "geoip {}" plugin. a) My logstash output is: output { if [type] == "paloalto" { elasticsearch { hosts =\> "localhost:9200" index =\> "fw-%{+YYYY.MM.dd}" template =\> "/usr/share/elasticsearch/template/geo-template.json" template\_overwrite =\> true } } } b) curl localhost:9200/\_template/logstash running successfully: {"logstash":{"order":0,"version":60001,".....ecc.... c) /usr/share/elasticsearch/template/geo-template.json is: { "template" : "logstash-_", "settings" : { "index.refresh\_interval" : "5s" }, "mappings" : { "default" : { "\_all" : {"enabled" : true}, "dynamic\_templates" : [ { "message\_field" : { "match" : "message", "match\_mapping\_type" : "string", "mapping" : { "type" : "string", "index" : "analyzed", "omit\_norms" : true } } }, { "string\_fields" : { "match" : "_", "match\_mapping\_type" : "string", "mapping" : { "type" : "string", "index" : "analyzed", "omit\_norms" : true, "fields" : { "raw" : {"type": "string", "index" : "not\_analyzed", "ignore\_above" : 256} } } } } ], "properties" : { "@version": { "type": "string", "index": "not\_analyzed" }, "geoip" : { "type" : "object", "dynamic": true, "path": "full", "properties" : { "location" : { "type" : "geo\_point", "lat\_lon" : true, "geohash" : true } } }, "fw\_SourceAddressGeo" : { "type" : "object", "dynamic": true, "path": "full", "properties" : { "location" : { "type" : "geo\_point", "lat\_lon" : true, "geohash" : true } } }, "fw\_DestinationAddressGeo" : { "type" : "object", "dynamic": true, "path": "full", "properties" : { "location" : { "type" : "geo\_point", "lat\_lon" : true, "geohash" : true } } } } } } d) When I try to restart the logstash service I have this error: [2018-05-03T10:19:08,865][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=\>"Got response code '400' contacting Elasticsearch at URL '[http://localhost:9200/\_template/logstash](http://localhost:9200/_template/logstash)'", :class=\>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError", :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:80:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in`perform\_request\_to\_url'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:278:in `block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in`with\_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:277:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in`block in put'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client.rb:345:in `template_put'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:85:in`template\_install'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/template\_manager.rb:21:in `install'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:9:in`install\_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:96:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:26:in`register'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator\_strategies/shared.rb:9:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:42:in`register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:353:in`block in register\_plugins'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:353:in`register\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:730:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:363:in`start\_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:250:in`block in start'"]}\*\* I have try to insert "order":1 before "settings" but doesn't change nothing. I don't understand the problem.......any idea? Thanking in advance. Best Regards Giuliano ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 31, 2018, 8:37am UTC](https://discuss.elastic.co/t/load-new-template-error-400/130402/2 "2018-05-31T08:37:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.