Logstash Tempalte Definition - Index Creation Fails

Elastic Stack Elasticsearch
1

Hello

I'm currently working with the latest version of ES, and just tried to create a custom template. I'm trying to define a 'standard' log source mapping template for my environment that I can use. So I would like to disable the dynamic mapping afterwards.

As a test, I just created a sample template very small, for example:
{ "template" : "my_*", "mappings" : { "my_type" : { "my_field" : { "type" : "string" } } } }

When I try to create an index however (I'm using Elastic-HQ for this), I get the following response:

{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [my_field : {type=string}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [my_type]: Root mapping definition has unsupported parameters: [my_field : {type=string}]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [my_field : {type=string}]"}},"status":400}

Similar reponse is logged when I try to let an index be created through ingestion with logstash. So I must be doing something wrong with the template I guess?

2

I think there may be a properties element missing:

{
  "template" : "my_*",
  "mappings" : {
    "properties": {
      "my_type" : {
        "my_field" : { "type" : "string" }
      }
    }
  }
}
3

Yep, thanks! And it seems that the "type" is required too, as root mapping can't be...modified like that? I guess...

At least I managed it with:

{
  "template" : "mytemplate*",
    "mappings" : {
    "syslog" : {
      "properties": {
                "@timestamp" : {
          "type" : "date",
          "format" : "strict_date_optional_time||epoch_millis"
        },
                "@version" : {
          "type" : "string"
        },
"ack_number" : {
....