# Logstash load multi template

**URL:** <https://discuss.elastic.co/t/logstash-load-multi-template/134824>\
**Category:** Logstash\
**Created:** [June 6, 2018, 2:19pm UTC](https://discuss.elastic.co/t/logstash-load-multi-template/134824 "2018-06-06T14:19:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![giuliano](https://avatars.discourse-cdn.com/v4/letter/g/ec9cab/32.png) [@giuliano](https://discuss.elastic.co/u/giuliano)\
**Post date:** [June 6, 2018, 2:19pm UTC](https://discuss.elastic.co/t/logstash-load-multi-template/134824/1 "2018-06-06T14:19:51Z")

</div>

Hi all...  
I use ELK 6.2.3.  
In logstash conf.d directory I have prepared two different configuration files for two different firewall with geo localization with a custom fields: "fw\_SourceGEO" and "fw\_DestinationGEO".  
I use two different index "fw\_customerA-_" and "fw\_customerB-_" for respecitve device. I have prepare two different template for set the type "geo\_point" to custom fields.

customerA.conf

output  
{  
if [type] == "fw\_deviceA"  
{  
elasticsearch  
{  
hosts =\> "localhost:9200"  
index =\> "fw\_customerA-%{+YYYY.MM.dd}"  
template =\> "/usr/share/elasticsearch/template/geoLocalization-customerA.json"  
template\_overwrite =\> "true"  
}  
}  
}

customeB.conf

output  
{  
if [type] == "fw\_deviceB"  
{  
elasticsearch  
{  
hosts =\> "localhost:9200"  
index =\> "fw\_customerB-%{+YYYY.MM.dd}"  
template =\> "/usr/share/elasticsearch/template/geoLocalization-customerB.json"  
template\_overwrite =\> "true"  
}  
}  
}

The problem concern that only for customerB is present the

"location": {  
"type": "geo\_point"

for customer A nothing!

From Kibana the GET \_template command said:

"logstash": {  
"order": 1,  
"index\_patterns": [  
"fw\_customerA\*"  
],  
....

I have try to rename the logstash config file (customerA.conf--\>customerB.conf) and viceversa and the template works now for "fw\_customerB" only.

I'd like to know how to load the different template for different index...if is possibile.....

Thanking in advance.

Giuliano

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 10, 2018, 8:33pm UTC](https://discuss.elastic.co/t/logstash-load-multi-template/134824/2 "2018-06-10T20:33:21Z")

</div>

Use the elasticsearch output's `template_name` option to give your templates different names.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2018, 8:33pm UTC](https://discuss.elastic.co/t/logstash-load-multi-template/134824/3 "2018-07-08T20:33:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.