# Problem with elastic template in Logstash when indexing
**URL:** https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751
**Category:** Logstash
**Created:** [August 9, 2018, 7:19pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751 "2018-08-09T19:19:02Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [August 9, 2018, 7:19pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/1 "2018-08-09T19:19:02Z")
i have a working index in Logstash version 5.x but its not working in version 6.3.2
date fields are not reading as date. it's reading as keyword
please help
```
{
"template" : "index_i",
"settings": { "index.refresh_interval": "5s" },
"mappings" : {
"index_i" : {
"properties": {
"Start Time": { "type": "date" , "format" : "MM-dd-YYYY HH:mm" } ,
"End Time": { "type": "date" , "format" : "MM-dd-YYYY HH:mm" } ,
"Process Name": { "type": "keyword" , "fielddata": true } ,
"User Name": {"type":"keyword" , "fielddata": true }
}
}
}
}
```
My logstash config file as below
```
input {
file {
path => "C:\test.csv"
start_position => "beginning"
sincedb_path => "C:/Logstash/sincedb/*"
}
}
filter {
csv {
skip_empty_columns => true
skip_header => true
skip_empty_rows => true
columns => ["Start Time","End Time","ProcessName","User Name"]
separator => ","
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "index_i"
template => "C:\test.json"
document_id => "%{Process Name}"
}
stdout {
codec => rubydebug
}
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2018, 5:53am UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/2 "2018-08-10T05:53:55Z")
See the index template documentation for ES 6.3. Your template is missing an `index_templates` option.
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [August 10, 2018, 6:45am UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/3 "2018-08-10T06:45:32Z")
> [@magnusbaeck](#):
>
> index\_templates
i edited template like this, still not working, what is the issue ?
```
{
"index_patterns" : "index_i",
"settings": { "number_of_shards": 1 },
"mappings" : {
"_doc" : {
"_source": {
"enabled": false
},
"properties": {
"Start Time": { "type": "date" , "format" : "MM/dd/YYYY HH:mm" } ,
"End Time": { "type": "date" , "format" : "MM/dd/YYYY HH:mm" } ,
"Process Name": { "type": "keyword" , "fielddata": true } ,
"User Name": {"type":"keyword" , "fielddata": true }
}
}
}
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2018, 7:07am UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/4 "2018-08-10T07:07:30Z")
I'd verify that the template has been properly stored in ES (use the get index template API), then delete the index\_i index, recreated it, and inspect its mappings with the get mapping API. Does the recreated index still have the wrong mappings?
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [August 10, 2018, 1:21pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/5 "2018-08-10T13:21:35Z")
when i check **GET _template/index\_i_** , i didn't get any output
but when i did **_GET index\_i_** , i get same template with date fields saved as keyword
what am doing wrong ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2018, 1:51pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/6 "2018-08-10T13:51:54Z")
Since you haven't overridden the `template_name` option in your elasticsearch output the template will be saved under the name "logstash", so you should issue a `GET /_template/logstash` request.
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [August 10, 2018, 3:21pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/7 "2018-08-10T15:21:29Z")
but why is using logstash template , am specifying template through config file
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [August 10, 2018, 3:39pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/8 "2018-08-10T15:39:12Z")
i manually added template through kibana.
i edited my config as below to specify the template **_index\_i_**
```
input {
file {
path => "C:\test.csv"
start_position => "beginning"
sincedb_path => "C:/Logstash/sincedb/*"
}
}
filter {
csv {
skip_empty_columns => true
skip_header => true
skip_empty_rows => true
columns => ["StartTime","EndTime","ProcessName","UserName"]
separator => ","
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "index_i"
template_name => "index_i"
document_id => "%{ProcessName}"
}
stdout {
codec => rubydebug
}
}
```
still am having same issue it's not using the template i specified
 
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2018, 5:09pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/9 "2018-08-10T17:09:09Z")
Now you're not specifying the path to your template so Logstash is overwriting whatever template you may have uploaded under the index\_i name. Again:
- Verify that the index\_i template has been properly stored in ES (use the get index template API).
- Delete the index\_i index via the ES API.
- Recreate it via the ES API.
- Fetch the mappings with the get mapping API. Are they what you expect?
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [August 10, 2018, 5:27pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/10 "2018-08-10T17:27:48Z")
- I deleted the **_index\_i_** index from elastic through ES Delete API
- Then i uploaded the template via ES PUT command
- Then i run the logstash config file as above
- I specified the template in config as **_template\_name_** , not as a json file. because i already uploded it
Still i am having issue, in the logstash cmd window saying , it is using logstash-\* template, not using the one i specified through **_template\_name_**
after running logstash config , do i need to anything extra ?
Is there anything wrong with template or config file ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 11, 2018, 5:30pm UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/11 "2018-08-11T17:30:47Z")
If you want any further help you need to follow my instructions **exactly**.
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [August 13, 2018, 5:20am UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/12 "2018-08-13T05:20:58Z")
Ok.
I uploaded template manually to elasticsearch through put command.
So what should I specify in **_template/template\_name_** in logstash elasticsearch output section?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 13, 2018, 6:15am UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/13 "2018-08-13T06:15:32Z")
> I uploaded template manually to elasticsearch through put command.
Yes...? And the template was applied when you created an index via the API?
> So what should I specify in _ **template/template\_name** _ in logstash elasticsearch output section?
The `template_name` option doesn't determine which index template is applied to the added document. It's the index pattern field in each template you should pay attention to. If you've saved templates under various names you should probably clean them up.
So, the `template` option should point to the path of the index template you want to store under the name given in the `template_name` option. It's up to you to make sure that the contents of that template (i.e. the template's index pattern) matches the indexes you're creating.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 10, 2018, 6:15am UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751/14 "2018-09-10T06:15:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.