Hello, everybody!
In short I have an app that generates new index template and send it into elastic on startup. Logs are shipped by Filebeat.
In case then I start my app when ES cluster is down I have a job that trying to resend templates until ES get template successfully.
So what will be when job failed again (assume we trying send templates one per minute) but right afrer then elastic will up? Filebeat starts send logs to elastic without applied index template and use auto mapping.
Can I disable auto index creation if no matching templates found and not allow publish events until required template is sent to ES?
Can I use action.auto_create_index property in this case or I have to configure elastic somehow else?