Logstash 7.0 does ignore index_patterns / template fields in template and overrules that with "logstash-*"

I was using elastic stack 6.52 before and upgraded to 7.0 recently. Now it seems that my index templates are no longer updated correctly. I use the elasticsearch output plugin to install my template with following configuration (regarding template):

output {
    elasticsearch {
            manage_template => true
            template => "/usr/share/logstash/templates/my_mapping.json"
            template_name => "my_index_template"
            template_overwrite => true

The template looks like this:

    "index_patterns" : ["my-index-name*"],
    "settings" : {
        "index.refresh_interval" : "10s",
        "index.number_of_shards" : 3,
        "index.number_of_replicas" : 0
    "mappings" : {
        "numeric_detection" : true

Now when logstash creates a index the following log message shows, that logstash uses that template but always overwrites my index_patterns with "logstash-*" or probably just ignores them. Here an example log line:

[2019-05-02T11:36:17,388][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"settings"=>{"index.refresh_interval"=>"10s", "index.number_of_shards"=>3, "index.number_of_replicas"=>0, "index.lifecycle.name"=>"logstash-policy", "index.lifecycle.rollover_alias"=>"logstash"}, "mappings"=>{"numeric_detection"=>true}, "index_patterns"=>"logstash-*"}}

I also tried with the deprecated field "template" instead of "index_patterns" but had the same effect. When I put the same template directly to elasticsearch it's working.

Does anybody know what I'm missing here? Or was there a change in the elasticsearch output plugin which is not stated in the "Breaking Changes" section for logstash 7.0?

Thank's in advance for some help!

Seems that I was not the only one with that issue but did not search enough I guess :innocent:


The described workaround (ilm_enabled => false) works for me too and I can wait for the fixed version...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.