# Logstash - Startup - Template, Exception in start **URL:** \ **Category:** Logstash\ **Created:** [May 4, 2018, 10:40pm UTC](https://discuss.elastic.co/t/logstash-startup-template-exception-in-start/130688 "2018-05-04T22:40:41Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Karthik\_Ramachandran](https://avatars.discourse-cdn.com/v4/letter/k/f19dbf/32.png) [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Post date:** [May 4, 2018, 10:40pm UTC](https://discuss.elastic.co/t/logstash-startup-template-exception-in-start/130688/1 "2018-05-04T22:40:41Z")
ES Version 6.2.1 Logstash Version (6.0.1 and 6.2.4). I'm observing multiple logstash templates being created, and was not clear on these. Environment: 2 Clusters - Cluster 1 Core Logging Cluster for keeping business data - Cluster 2 Monitoring Cluster where Logstash (Xpack) monitoring, and CLuster 1 (XPack) monitoring send data I observe below templates in these clusters Core Logging Cluster logstash-index-template [.logstash] Monitoring Cluster .monitoring-logstash [.monitoring-logstash-6-_] .monitoring-logstash-2 [.monitoring-logstash-2_] Clarifications 1. When these templates are created? I believe .monitoring-logstash are created when xpack is enabled in logstash, but not sure why we get two versions .monitoring-logstash being created. The indices follow only .monitoring-logstash-6-\* in monitoring cluster 2. logstash-index-template? How and when it is created. I don't see any indices as specified by template 3. Whenever I start the logstash, I see below error in it. Refer to highlighted text. [2018-05-04T22:03:24,209][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}} [2018-05-04T22:03:24,261][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=\>"Got response code '403' contacting Elasticsearch at URL ' **https://\<\>:9200/\_template/logstash**'", :class=\>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError", :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:80:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in`perform\_request\_to\_url'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:278:in `block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in`with\_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:277:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in`block in Pool'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http\_client.rb:338:in `template_exists?'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:81:in`template\_install'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/template\_manager.rb:21:in `install'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/template_manager.rb:9:in`install\_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:96:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:26:in`register'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator\_strategies/shared.rb:9:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:42:in`register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:353:in`block in register\_plugins'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:353:in`register\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:730:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:363:in`start\_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:250:in`block in start'"]} Based on the error, I have few more queries 3.1. Logstash start is trying to search a template named logstash in Logging Cluster, which will not be found. Not sure what is being done and why I get this error. Moreover why would logstash try to install/search template in logging cluster. The output plugin has output configured to write against specific indices in pipeline at logging cluster, and access the logging cluster using specific user/pwd. The pipeline work fine though 3.2 Refer to 403 response code. What security credentials it is using to access logging cluster during startup? Thanks for clarification ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [May 5, 2018, 12:25am UTC](https://discuss.elastic.co/t/logstash-startup-template-exception-in-start/130688/2 "2018-05-05T00:25:36Z")
the elasticsearch output in your logging pipeline appears to be configured to push a template for the Elasticsearch index, but when it does so it is receiving an `403 Forbidden`; is the target logging cluster password-protected? if so, you will need to set the output's [`user`](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-user) and [`password`](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-password) parameters with appropriate credentials. ---
**Author:** ![Karthik\_Ramachandran](https://avatars.discourse-cdn.com/v4/letter/k/f19dbf/32.png) [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Post date:** [May 7, 2018, 6:30pm UTC](https://discuss.elastic.co/t/logstash-startup-template-exception-in-start/130688/3 "2018-05-07T18:30:33Z")
Hi Ry Validated the pipelines, but they all write data to indices and doesn't create a template. This is the only output configuration we have for all pipelines. output { elasticsearch { id =\> "elasticsearch.output" hosts =\> [""] index =\> "%{type}.log.%{tier}" user =\> "" password =\> "" ssl =\> true ssl\_certificate\_verification =\> true cacert =\> "" } } type and tier are set at input to qualify a indice to where the data is logged to. All the output by type and tier is working fine and data is indexed. The error comes at startup, and not continuous. Also, it would be helpful if you can provide clarification on other two queries (1 &2) around indice templates being created. ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [May 10, 2018, 8:13am UTC](https://discuss.elastic.co/t/logstash-startup-template-exception-in-start/130688/4 "2018-05-10T08:13:55Z")
Documentation for template management can be found here: [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-manage\_template](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-manage_template) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 7, 2018, 8:13am UTC](https://discuss.elastic.co/t/logstash-startup-template-exception-in-start/130688/5 "2018-06-07T08:13:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.