# Load the index template manually(alternate method)

**URL:** https://discuss.elastic.co/t/load-the-index-template-manually-alternate-method/141205
**Category:** Beats
**Tags:** winlogbeat
**Created:** [July 23, 2018, 3:14pm UTC](https://discuss.elastic.co/t/load-the-index-template-manually-alternate-method/141205 "2018-07-23T15:14:01Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)
#### Post date: [July 23, 2018, 3:14pm UTC](https://discuss.elastic.co/t/load-the-index-template-manually-alternate-method/141205/1 "2018-07-23T15:14:02Z")

</div>

Hi,

I am running Winlogbeat on a machine which doesn't have access to elasticsearch. So, I will need to load the index template manually(Winlogbeat outputs to Logstash) with alternate method. I have few questions,

- I am running Winlogbeat on nearly 30 windows machines and I didn't load the index template earlier and now I am planning to load the index template. Would there be any issues if I load the index template on existing data which is being sent using logstash?

- Also, since there are 30 machines, do I need to export index template to a file on all 30 servers using  
`PS> .\winlogbeat.exe export template --es.version 6.3.1 | Out-File -Encoding UTF8 winlogbeat.template.json`

- All these 30 machines send logs to different indices(5 different indices meaning 6 machines per product) in elasticsearch(through Logstash). So, do I need to load the index template per indices? If so, how do I do it?. Because the below command doesn't specify any index,  
`curl -XPUT -H 'Content-Type: application/json' http://localhost:9200/_template/winlogbeat-6.3.1 -d@winlogbeat.template.json`

Please help me understand this concept. Thanks in advance!

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [July 24, 2018, 2:46pm UTC](https://discuss.elastic.co/t/load-the-index-template-manually-alternate-method/141205/2 "2018-07-24T14:46:55Z")

</div>

You only need to install the template once. So you will export it from one Winlogbeat instance and install it to Elasticsearch. If you update Winlogbeat versions then you should install the updated template first.

After you have exported the file you can modify it manually to ensure that it applies to all of your indexes. Inside the file is an array called `index_patterns` that needs to match all of your indices.

When you install the template **it will not** apply to existing indices. Index templates are used at index creation time to establish the mapping for the index.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 21, 2018, 2:47pm UTC](https://discuss.elastic.co/t/load-the-index-template-manually-alternate-method/141205/3 "2018-08-21T14:47:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
