# Logstash load my template failed with bad response error code 400

**URL:** https://discuss.elastic.co/t/logstash-load-my-template-failed-with-bad-response-error-code-400/204786
**Category:** Logstash
**Created:** [October 23, 2019, 6:41am UTC](https://discuss.elastic.co/t/logstash-load-my-template-failed-with-bad-response-error-code-400/204786 "2019-10-23T06:41:51Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)
#### Post date: [October 23, 2019, 6:41am UTC](https://discuss.elastic.co/t/logstash-load-my-template-failed-with-bad-response-error-code-400/204786/1 "2019-10-23T06:41:51Z")

</div>

Hi Experts,

I have designed a customized template will be loaded during start logstash. But logstash loads it failed with error code 400. The failed report shows as below:

> [2019-10-23T14:33:27,893][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"lsh\*\_nokiasbc-_", "settings"=\>{"index.refresh\_interval"=\>"5s"}, "default"=\>{"total\_fields"=\>{"limit"=\>"3000"}}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "omit\_norms"=\>true}, "dynamic\_templates"=\>[{"message\_field"=\>{"match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"string", "index"=\>"analyzed", "omit\_norms"=\>true}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"string", "index"=\>"analyzed", "omit\_norms"=\>true, "fields"=\>{"raw"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "ignore\_above"=\>256}}}}}], "properties"=\>{"@version"=\>{"type"=\>"string", "index"=\>"not\_analyzed"}, "application"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "hostname"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "level"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "class"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "method"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "thread"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "syslog\_program"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "syslog\_hostname"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "eventid"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "module"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "errortype"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "src"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "sev"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "geoip"=\>{"type"=\>"object", "dynamic"=\>true, "properties"=\>{"location"=\>{"type"=\>"geo\_point"}}}}}}}}  
> [2019-10-23T14:33:27,966][INFO][logstash.outputs.elasticsearch] Installing elasticsearch template to \_template/nokiasbcsig  
> [2019-10-23T14:33:28,056][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=\>"Got response code '400' contacting Elasticsearch at URL '[http://localhost:9200/\_template/nokiasbcsig](http://localhost:9200/_template/nokiasbcsig)'", :class=\>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError", :backtrace=\>["/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:80:in `perform_request'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in `perform\_request\_to\_url'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:278:in `block in perform_request'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in `with\_connection'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:277:in `perform_request'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in `block in Pool'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http\_client.rb:348:in `template_put'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:86:in `template\_install'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/template\_manager.rb:21:in `install'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:9:in `install\_template'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/common.rb:118:in `install_template'", "/home/admin/logtool/logstash-6.4.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.2.1-java/lib/logstash/outputs/elasticsearch/common.rb:49:in `block in install\_template\_after\_successful\_connection'"]}

Here is the output part of code in my logstash pattern.

```
output {

        stdout {
                codec => rubydebug
        }

        elasticsearch {
                hosts => ["localhost:9200"]
                ssl => false
                template => '/home/admin/logtool/logpattern/template/elasticsearch-template-nokiasbc.json'
                template_overwrite => true
                template_name => 'nokiasbcsig'
                index => "lsh_nokia_nokiasbcsig-%{+YYYY.MM.dd}"
        }
}

```

Would you please help me check the load failed issue?

Thank you.

---

<div class="post-metadata">

### Author: ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)
#### Post date: [October 23, 2019, 6:42am UTC](https://discuss.elastic.co/t/logstash-load-my-template-failed-with-bad-response-error-code-400/204786/2 "2019-10-23T06:42:31Z")

</div>

Additionally, here is the content of my template:

```
{
    "template": "lsh*_nokiasbc-*",
    "settings": {
        "index.refresh_interval": "5s"
    },
    "default": {
        "total_fields": {
            "limit": "3000"
        }
    },
    "mappings": {
        "_default_": {
            "_all": {
                "enabled": true,
                "omit_norms": true
            },
            "dynamic_templates": [{
                "message_field": {
                    "match": "message",
                    "match_mapping_type": "string",
                    "mapping": {
                        "type": "string",
                        "index": "analyzed",
                        "omit_norms": true
                    }
                }
            }, {
                "string_fields": {
                    "match": "*",
                    "match_mapping_type": "string",
                    "mapping": {
                        "type": "string",
                        "index": "analyzed",
                        "omit_norms": true,
                        "fields": {
                            "raw": {
                                "type": "string",
                                "index": "not_analyzed",
                                "ignore_above": 256
                            }
                        }
                    }
                }
            }],
            "properties": {
                "@version": {
                    "type": "string",
                    "index": "not_analyzed"
                },
            "application": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "hostname": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "level": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "class": { "type": "string", "index": "not_analyzed", "doc_values" : true },
                "method": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "thread": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "syslog_program": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "syslog_hostname": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "eventid": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "module": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "errortype": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "src": { "type": "string", "index": "not_analyzed", "doc_values" : true },
            "sev": { "type": "string", "index": "not_analyzed", "doc_values" : true },

                "geoip": {
                    "type": "object",
                    "dynamic": true,
                    "properties": {
                        "location": {
                            "type": "geo_point"
                        }
                    }
                }
            }
        }
    }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 20, 2019, 6:54am UTC](https://discuss.elastic.co/t/logstash-load-my-template-failed-with-bad-response-error-code-400/204786/3 "2019-11-20T06:54:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
