# Restore arcsight\_logs\_template index template created by ArcSight Module?
**URL:** https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103
**Category:** Logstash
**Created:** [February 6, 2020, 7:42am UTC](https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103 "2020-02-06T07:42:01Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@undelete](https://discuss.elastic.co/u/undelete)
#### Post date: [February 6, 2020, 7:42am UTC](https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103/1 "2020-02-06T07:42:01Z")
Hi, not sure if Elasticsearch is the correct category. However I used the Dev Tools in Kibana to update the pre-created index template arcsight\_logs\_template, created by the ArcSight Module. I updated the number\_of\_replicas setting but when I looked to see if my setting was saved in the index template, now it only contains number\_of\_replicas setting, everything else + mappings is gone. Is there any way to restore the arcsight\_logs\_template? I do not use snapshots or have backup.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [February 6, 2020, 7:59am UTC](https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103/2 "2020-02-06T07:59:59Z")
I moved the question to #beats:filebeat.
Probably there is somewhere on disk the template that was used initially? But I'm not a filebeat expert 😉
Another solution could be to start a local elasticsearch + filebeat with arcsight module and let it write the index template. Then `GET _template/arcsight_logs_template` and use it in the production cluster?
---
### Author:  [@undelete](https://discuss.elastic.co/u/undelete)
#### Post date: [February 6, 2020, 12:04pm UTC](https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103/3 "2020-02-06T12:04:49Z")
Hi, I have never used FileBeat. This is from the Logstash Module, so perhaps Logstash is the correct category. Anyone working with Logstash Modules on your side that can answer this?
---
### Author:  [@undelete](https://discuss.elastic.co/u/undelete)
#### Post date: [February 10, 2020, 6:01am UTC](https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103/4 "2020-02-10T06:01:19Z")
I recreated the index template by copying the content in an existing index. However I had to remove the "syslog" type, and use \_doc type". I found a bug report about "syslog" and I guess it will be fixed in the future.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2020, 6:01am UTC](https://discuss.elastic.co/t/restore-arcsight-logs-template-index-template-created-by-arcsight-module/218103/5 "2020-03-09T06:01:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.