# Logstash Doesn't Apply Elastic Template

**URL:** <https://discuss.elastic.co/t/logstash-doesnt-apply-elastic-template/63083>\
**Category:** Logstash\
**Created:** [October 14, 2016, 8:48pm UTC](https://discuss.elastic.co/t/logstash-doesnt-apply-elastic-template/63083 "2016-10-14T20:48:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mormaii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mormaii/32/10790_2.png) [@Mormaii](https://discuss.elastic.co/u/Mormaii)\
**Post date:** [October 14, 2016, 8:48pm UTC](https://discuss.elastic.co/t/logstash-doesnt-apply-elastic-template/63083/1 "2016-10-14T20:48:21Z")

</div>

Logstash config:

```
if [application] == "api_xalok_varnish" {

    elasticsearch {
        template => "/etc/logstash/templates/api_xalok_varnish.json"
        template_name => "api_xalok_varnish"
        template_overwrite => true
        index => "%{+YYYY-MM-dd}-api_xalok_varnish"
        hosts => ["192.168.253.128:9200"]
    }
}

```

Template here:

```
{
  "template" : "*-api_xalok_varnish" : {
    "mappings" : {
      "logs" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date",
            "format" : "strict_date_optional_time||epoch_millis"
          },
          "application" : {
            "type" : "string"
          },
          "hostname" : {
            "type" : "string"
          },
          "site" : {
            "type" : "string"
          },
          "tag" : {
            "type" : "string",
            "string" : "not_analyzed"
          },
          "url" : {
            "type" : "string",
            "string" : "not_analyzed"
          },
          "when" : {
            "properties" : {
              "_i" : {
                "type" : "long"
              }
            }
          }
        }
      }
    }
  }
}

```

This is what my mapping looks on my ES:

```
{
  "2016-10-14-api_xalok_varnish" : {
    "mappings" : {
      "logs" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date",
            "format" : "strict_date_optional_time||epoch_millis"
          },
          "application" : {
            "type" : "string"
          },
          "hostname" : {
            "type" : "string"
          },
          "site" : {
            "type" : "string"
          },
          "tag" : {
            "type" : "string"
          },
          "url" : {
            "type" : "string"
          },
          "when" : {
            "properties" : {
              "_i" : {
                "type" : "long"
              }
            }
          }
        }
      }
    }
  }
}

```

It isn't applying the "not\_analyzed", the weird part is that I have already 4 other templates and they work perfectly but this one doesn't.

---

<div class="post-metadata">

**Author:** ![Mormaii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mormaii/32/10790_2.png) [@Mormaii](https://discuss.elastic.co/u/Mormaii)\
**Post date:** [October 14, 2016, 8:55pm UTC](https://discuss.elastic.co/t/logstash-doesnt-apply-elastic-template/63083/2 "2016-10-14T20:55:17Z")

</div>

Fixed template by using it like this (sorry):

```
{
  "template" : "*-api_xalok_varnish",
    "mappings" : {
      "logs" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date",
            "format" : "strict_date_optional_time||epoch_millis"
          },
          "application" : {
            "type" : "string"
          },
          "hostname" : {
            "type" : "string"
          },
          "site" : {
            "type" : "string"
          },
          "tag" : {
            "type" : "string",
            "string" : "not_analyzed"
          },
          "url" : {
            "type" : "string",
            "string" : "not_analyzed"
          },
          "when" : {
            "properties" : {
              "_i" : {
                "type" : "long"
              }
            }
          }
        }
      }
    }
  }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/logstash-doesnt-apply-elastic-template/63083/3 "2017-07-06T04:34:10Z")

</div>