I was using elastic stack 6.52 before and upgraded to 7.0 recently. Now it seems that my index templates are no longer updated correctly. I use the elasticsearch output plugin to install my template with following configuration (regarding template):
output {
elasticsearch {
#...
manage_template => true
template => "/usr/share/logstash/templates/my_mapping.json"
template_name => "my_index_template"
template_overwrite => true
#...
}
}
The template looks like this:
{
"index_patterns" : ["my-index-name*"],
"settings" : {
"index.refresh_interval" : "10s",
"index.number_of_shards" : 3,
"index.number_of_replicas" : 0
},
"mappings" : {
"numeric_detection" : true
}
}
Now when logstash creates a index the following log message shows, that logstash uses that template but always overwrites my index_patterns with "logstash-*" or probably just ignores them. Here an example log line:
[2019-05-02T11:36:17,388][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"settings"=>{"index.refresh_interval"=>"10s", "index.number_of_shards"=>3, "index.number_of_replicas"=>0, "index.lifecycle.name"=>"logstash-policy", "index.lifecycle.rollover_alias"=>"logstash"}, "mappings"=>{"numeric_detection"=>true}, "index_patterns"=>"logstash-*"}}
I also tried with the deprecated field "template" instead of "index_patterns" but had the same effect. When I put the same template directly to elasticsearch it's working.
Does anybody know what I'm missing here? Or was there a change in the elasticsearch output plugin which is not stated in the "Breaking Changes" section for logstash 7.0?
Thank's in advance for some help!