Same index pattern but different index template

Elastic Stack Elasticsearch
1

Good day!

I just have a question regarding on Index Template
is it possible to create a different index template but same index pattern?

What I am going to do is to create a index template but same name on the index pattern on my existing index template.

I have new test server and I just installed beats on there, I just want to shipped the logs on the existing data stream. So, that I can avoid creating new data stream and indices

2

Index templates have priority. As the interface shows, only the highest priority will be applied:

image
image774×81 5.62 KB

3

Hi @chouben thank you for your kind response.

is this option for Kibana API?
What about when you load your index template using logstash?
Does it mean, it cannot install because of the priority settings?

4

You can specify the priority in the body of the template as explained in the documentation.

Bu it is not clear what you want to do, if you have two templates for the same index pattern, the template with the highest priority will be applied and will override settings in the template with the lower priority.

Is this what you want?

5

I have 2 beats installed on different servers (filebeat, winlogbeat)

What I want to do when I create an index template for the beats I want them to have the same data stream name because I have an existing data stream.

I don't want to create another data stream when creating a new Index template.

is that possible?

Thank you @leandrojmp for your response.
Appreciate it.

6

So you have multiple steps:

  1. Configure the index pattern in your beats, make them all point to the same pattern
    E.g. Filbeat docs
  2. Configure the index templates (with highest priority) to match your index pattern in elasticsearch (can be done via Kibana), so you got control for e.g. datastream, ILM, replication, ...

Good luck!

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.