# Preferred way to set the 'final\_pipeline' back to '\_none' for all indices

**URL:** <https://discuss.elastic.co/t/preferred-way-to-set-the-final-pipeline-back-to-none-for-all-indices/374450>\
**Category:** Logs\
**Created:** [February 12, 2025, 6:09pm UTC](https://discuss.elastic.co/t/preferred-way-to-set-the-final-pipeline-back-to-none-for-all-indices/374450 "2025-02-12T18:09:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ameindel](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@ameindel](https://discuss.elastic.co/u/ameindel)\
**Post date:** [February 12, 2025, 6:09pm UTC](https://discuss.elastic.co/t/preferred-way-to-set-the-final-pipeline-back-to-none-for-all-indices/374450/1 "2025-02-12T18:09:25Z")

</div>

Hello, Elastic!

As the title implies, I was wondering if there's a preferred way to set the 'final\_pipeline' back to '\_none' for _all_ indices.

Originally, I set the final pipeline to point at an Ingest Pipeline that used regex redactor Processors via a Component Template tacked on to the end of our log's Index Template. After determining that the regex redaction wasn't going to meet our PII redaction requirements, I backed the change out by deleting the Component Template that explicitly set the final pipeline.

However, a large number of indices had auto-rolled over and picked up the final pipeline setting change. After backing out/deleting my Component Template from our logs Index Template and manually rolling over a couple indices, I noticed that the final pipeline setting is still set.

It looks like the final pipeline needs to be explicitly set back to none, but what I don't want to do is to have to manually run a POST command that sets that setting for each index (we have hundreds of them).

What I was thinking on doing is adding back a Component Template that explicitly sets the final pipeline back to none and then just waiting for the indices to auto-roll over again. I would like to know if this is an acceptable way to essentially reset the final pipeline setting back to none for all indices, or if there's a better way to do that.

Thanks in advance!

Adam

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 12, 2025, 7:51pm UTC](https://discuss.elastic.co/t/preferred-way-to-set-the-final-pipeline-back-to-none-for-all-indices/374450/2 "2025-02-12T19:51:40Z")

</div>

you can use wildcards

```auto
POST my-index-1/_doc
{
  "foo" : "bar"
}

POST my-index-2/_doc
{
  "foo" : "bar"
}

PUT /my-index-*/_settings
{
  "index.default_pipeline": "test"
}

GET my-index-*/_settings

PUT /my-index-*/_settings
{
  "index.default_pipeline": null
}

```

You can also us the `_all` directive to apply settings to all indices that you have access to... **CAUTION** do not make a misake!!!

```auto
PUT /_all/_settings
{
  "index.default_pipeline": null
}

```

---

<div class="post-metadata">

**Author:** ![ameindel](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@ameindel](https://discuss.elastic.co/u/ameindel)\
**Post date:** [February 13, 2025, 1:44pm UTC](https://discuss.elastic.co/t/preferred-way-to-set-the-final-pipeline-back-to-none-for-all-indices/374450/3 "2025-02-13T13:44:15Z")

</div>

Great, I'll try that. Thanks for the reply, @stephenb!