I've been trying for a few days now to add custom mapping (geo_point) to my elasticsearch server. This server has daily created indices "filebeat-2019.08.22". However, all documentation tells me I need to update the template, but I cannot find what the name of this template is.
I have tried to create the mapping through creating a template named "filebeat", and one named "filebeat-*" and one named "filebeat*" but none seem to work or show the information in the next created index.
One thing I tried yesterday is this:
curl -X PUT "localhost:9200/_template/filebeat?pretty" -H 'Content-Type: application/json' -d'
{
"index_patterns" : ["filebeat-*"],
"order" : 1,
"settings" : {
"index.refresh_interval" : "5s",
"number_of_replicas" : "0"
},
"properties": {
"geoip": {
"dynamic": true,
"properties": {
"location": {
"type": "geo_point"
}
}
}
}
}
This did not produce anything with regard to the geo_point, but it seems it did do something with the replicas (which I also needed to set to 0), so it worked partially.
Requesting the template shows this:
{"filebeat":{"order":1,"index_patterns":["filebeat-*"],"settings":{"index":{"number_of_replicas":"0","refresh_interval":"5s"}},"mappings":{},"aliases":{}}}
So it seems it did not take the properties.
Basically the question here is. How do I get a property to change in the next created index? Also if you dont know the index name (indices are created like filebeat-xxxx.xx.xx but from which template?), can you (like I did or tried to do) simply create a new template with reference to the index pattern and it will take?