We specify a template file to use in our logstash elastic output definition in our conf files. We currently have one template file per index, and each contains some common field definitions. We'd like to simplify this and can see a couple of options.
One option is to devise a single unified template, which I'm reticent to do yet.
The other option would be to use multiple templates and overlay them using the order. But I think this would mean that we would no longer specify them in the logstash config file. Is that correct? Or can we specify multiple template files in the config?
Also, is there a best practice for managing templates for multiple indices, each containing some common fields and some index-specific fields? We currently don't have a case where the same field name intentionally has different mappings in different indices.