# Need help creating index template

**URL:** <https://discuss.elastic.co/t/need-help-creating-index-template/15503>\
**Category:** Elasticsearch\
**Created:** [January 30, 2014, 4:47pm UTC](https://discuss.elastic.co/t/need-help-creating-index-template/15503 "2014-01-30T16:47:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Glenn\_Poston](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/glenn_poston/32/1833_2.png) [@Glenn\_Poston](https://discuss.elastic.co/u/Glenn_Poston)\
**Post date:** [January 30, 2014, 4:47pm UTC](https://discuss.elastic.co/t/need-help-creating-index-template/15503/1 "2014-01-30T16:47:28Z")

</div>

I've been working in this problem for 2 days now and I can't seem to find  
the information I need to figure out a solution.

I'm using logstash to parse AWS cloudtrail logs. I'm having trouble  
creating an index template that does what I want. Here is the doc in  
elasticsearch. The contents of the requestParameters element is dynamic.  
Because of this fact, after several hours of docs are created I have tons  
of fields for different requestParameters that I don't really want. I  
would like the contents of that element to be stored as a single field that  
is a string representation of the json blob for that element (i.e.  
requestParameters = { "filterSet": { "items": [ { "name": "resource-id",  
"valueSet": { "items": [{ "value": "i-3bd4461a"}] } ] }). (if that is  
not possible, I would like the field to not be created at all).

{  
"\_index": "logstash-2014.01.30",  
"\_type": "logs",  
"\_id": "JOGAYVL5RNy5UX7fIVG45w",  
"\_score": null,  
"\_source": {  
_..._  
"requestParameters": {  
"filterSet": {  
"items": [  
{  
"name": "resource-id",  
"valueSet": {  
"items": [  
{  
"value": "i-3bd4461a"  
}  
]  
}  
}  
]  
}  
},  
...  
},  
_..._  
}

The template I'm currently using is the default logstash template (below).

{  
"logstash" : {  
"template" : "logstash-_",  
"order" : 0,  
"settings" : {  
"index.analysis.analyzer.default.stopwords" : "none",  
"index.refresh\_interval" : "5s",  
"index.analysis.analyzer.default.type" : "standard"  
},  
"mappings" : {  
"default" : {  
"dynamic\_templates" : [ {  
"string\_fields" : {  
"mapping" : {  
"type" : "multi\_field",  
"fields" : {  
"raw" : {  
"index" : "not\_analyzed",  
"ignore\_above" : 256,  
"type" : "string"  
},  
"{name}" : {  
"index" : "analyzed",  
"omit\_norms" : true,  
"type" : "string"  
}  
}  
},  
"match\_mapping\_type" : "string",  
"match" : "_"  
}  
} ],  
"properties" : {  
"geoip" : {  
"dynamic" : true,  
"path" : "full",  
"properties" : {  
"location" : {  
"type" : "geo\_point"  
}  
},  
"type" : "object"  
},  
"@version" : {  
"index" : "not\_analyzed",  
"type" : "string"  
}  
},  
"\_all" : {  
"enabled" : true  
}  
}  
}  
}  
}

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/23b35b57-e959-4087-a937-2d61df56841a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/23b35b57-e959-4087-a937-2d61df56841a%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:53am UTC](https://discuss.elastic.co/t/need-help-creating-index-template/15503/2 "2017-07-06T01:53:55Z")

</div>

Closed on July 6, 2017, 1:53am UTC