# Logstash Tempalte Definition - Index Creation Fails

**URL:** https://discuss.elastic.co/t/logstash-tempalte-definition-index-creation-fails/36299
**Category:** Elasticsearch
**Created:** [December 3, 2015, 3:12pm UTC](https://discuss.elastic.co/t/logstash-tempalte-definition-index-creation-fails/36299 "2015-12-03T15:12:56Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![inzanez](https://avatars.discourse-cdn.com/v4/letter/i/7ea924/32.png) [@inzanez](https://discuss.elastic.co/u/inzanez)
#### Post date: [December 3, 2015, 3:12pm UTC](https://discuss.elastic.co/t/logstash-tempalte-definition-index-creation-fails/36299/1 "2015-12-03T15:12:56Z")

</div>

Hello

I'm currently working with the latest version of ES, and just tried to create a custom template. I'm trying to define a 'standard' log source mapping template for my environment that I can use. So I would like to disable the dynamic mapping afterwards.

As a test, I just created a sample template very small, for example:  
`{ "template" : "my_*", "mappings" : { "my_type" : { "my_field" : { "type" : "string" } } } }`

When I try to create an index however (I'm using Elastic-HQ for this), I get the following response:

`{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [my_field : {type=string}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [my_type]: Root mapping definition has unsupported parameters: [my_field : {type=string}]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [my_field : {type=string}]"}},"status":400}`

Similar reponse is logged when I try to let an index be created through ingestion with logstash. So I must be doing something wrong with the template I guess?

---

<div class="post-metadata">

### Author: ![jochen\_st](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jochen\_st](https://discuss.elastic.co/u/jochen_st)
#### Post date: [December 3, 2015, 3:43pm UTC](https://discuss.elastic.co/t/logstash-tempalte-definition-index-creation-fails/36299/2 "2015-12-03T15:43:17Z")

</div>

I think there may be a properties element missing:

```
{
  "template" : "my_*",
  "mappings" : {
    "properties": {
      "my_type" : {
        "my_field" : { "type" : "string" }
      }
    }
  }
}
```

---

<div class="post-metadata">

### Author: ![inzanez](https://avatars.discourse-cdn.com/v4/letter/i/7ea924/32.png) [@inzanez](https://discuss.elastic.co/u/inzanez)
#### Post date: [December 3, 2015, 3:47pm UTC](https://discuss.elastic.co/t/logstash-tempalte-definition-index-creation-fails/36299/3 "2015-12-03T15:47:02Z")

</div>

Yep, thanks! And it seems that the "type" is required too, as root mapping can't be...modified like that? I guess...

At least I managed it with:

```
{
  "template" : "mytemplate*",
    "mappings" : {
    "syslog" : {
      "properties": {
                "@timestamp" : {
          "type" : "date",
          "format" : "strict_date_optional_time||epoch_millis"
        },
                "@version" : {
          "type" : "string"
        },
"ack_number" : {
....
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:33pm UTC](https://discuss.elastic.co/t/logstash-tempalte-definition-index-creation-fails/36299/4 "2017-07-05T23:33:50Z")

</div>


