# \[SOLVED\] Dynamic template doesn't match any of my field

**URL:** <https://discuss.elastic.co/t/solved-dynamic-template-doesnt-match-any-of-my-field/89066>\
**Category:** Elasticsearch\
**Created:** [June 12, 2017, 2:56pm UTC](https://discuss.elastic.co/t/solved-dynamic-template-doesnt-match-any-of-my-field/89066 "2017-06-12T14:56:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Leclere](https://avatars.discourse-cdn.com/v4/letter/d/cc9497/32.png) [@David\_Leclere](https://discuss.elastic.co/u/David_Leclere)\
**Post date:** [June 12, 2017, 2:56pm UTC](https://discuss.elastic.co/t/solved-dynamic-template-doesnt-match-any-of-my-field/89066/1 "2017-06-12T14:56:19Z")

</div>

I 'am trying to configure a chain like this :

LOG \<--- FILEBEAT --\> LOGSTASH --\> ELASTICSEARCH

But the dynamic mapping i tried to use is not matching any field.

I specify a custom template in my elasticsearch output as below :

> output {  
> elasticsearch {  
> hosts =\> "[http://XXX.XXX.XXX.XXX:9200](http://XXX.XXX.XXX.XXX:9200)"  
> index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
> template =\> "/etc/logstash/template.json"  
> template\_overwrite =\> true  
> document\_type =\> "%{[@metadata][type]}"  
> document\_id =\> "%{fingerprint}"  
> }  
> }

Content of the template.json file is :

> {  
> "template" : "subscription-informations\*",  
> "mappings" : {  
> "log" : {  
> "dynamic\_templates": [  
> { "string\_template": {  
> "match\_mapping\_type": "string",  
> "mapping": {  
> "type": "string"  
> }}  
> },  
> { "integer\_template": {  
> "match": "_\_capacity",  
> "mapping": {  
> "type": "integer"  
> }}  
> },  
> { "date\_template": {  
> "match": "_\_date",  
> "mapping": {  
> "type": "date"  
> }}  
> },  
> { "ip\_template": {  
> "match": "\*\_ip",  
> "mapping": {  
> "type": "ip"  
> }}  
> }  
> ]  
> }  
> }  
> }

But when i get the template of my log type i got :

> {  
> "subscription-informations-2017.06.12":{  
> "mappings":{  
> "log":{  
> "dynamic\_templates":[  
> {  
> "string\_template":{  
> "match\_mapping\_type":"string",  
> "mapping":{  
> "type":"string"  
> }  
> }  
> },  
> {  
> "integer\_template":{  
> "match":"_\_capacity",  
> "mapping":{  
> "type":"integer"  
> }  
> }  
> },  
> {  
> "date\_template":{  
> "match":"_\_date",  
> "mapping":{  
> "type":"date"  
> }  
> }  
> },  
> {  
> "ip\_template":{  
> "match":"\*\_ip",  
> "mapping":{  
> "type":"ip"  
> }  
> }  
> }  
> ],  
> "properties":{  
> "@timestamp":{  
> "type":"date"  
> },  
> "@version":{  
> "type":"text"  
> },  
> "backup\_enabled":{  
> "type":"text"  
> },  
> "beat":{  
> "properties":{  
> "hostname":{  
> "type":"text"  
> },  
> "name":{  
> "type":"text"  
> },  
> "version":{  
> "type":"text"  
> }  
> }  
> },  
> "cpu\_capacity":{  
> "type":"text"  
> },  
> "datacenter\_name":{  
> "type":"text"  
> },  
> "disk\_capacity":{  
> "type":"text"  
> },  
> "fingerprint":{  
> "type":"text"  
> },  
> "host":{  
> "type":"text"  
> },  
> "input\_type":{  
> "type":"text"  
> },  
> "offset":{  
> "type":"long"  
> },  
> "owner\_mail":{  
> "type":"text"  
> },  
> "owner\_name":{  
> "type":"text"  
> },  
> "ram\_capacity":{  
> "type":"text"  
> },  
> "source":{  
> "type":"text"  
> },  
> "subscription\_creation\_date":{  
> "type":"date"  
> },  
> "subscription\_deletion\_date":{  
> "type":"date"  
> },  
> "subscription\_name":{  
> "type":"text"  
> },  
> "subscription\_status":{  
> "type":"text"  
> },  
> "subscription\_type":{  
> "type":"text"  
> },  
> "tags":{  
> "type":"text"  
> },  
> "type":{  
> "type":"text"  
> },  
> "virtualmachine\_id":{  
> "type":"text"  
> },  
> "virtualmachine\_ip":{  
> "type":"text"  
> },  
> "virtualmachine\_name":{  
> "type":"text"  
> }  
> }  
> }  
> }  
> }  
> }

What i'am missing ?

---

<div class="post-metadata">

**Author:** ![David\_Leclere](https://avatars.discourse-cdn.com/v4/letter/d/cc9497/32.png) [@David\_Leclere](https://discuss.elastic.co/u/David_Leclere)\
**Post date:** [June 12, 2017, 3:42pm UTC](https://discuss.elastic.co/t/solved-dynamic-template-doesnt-match-any-of-my-field/89066/2 "2017-06-12T15:42:22Z")

</div>

self answer in case of someone encouteers the same issue :

Elasticsearch uses the first matching dynamic template for each field. In my case all fields was mapped by my "string\_template".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2017, 3:42pm UTC](https://discuss.elastic.co/t/solved-dynamic-template-doesnt-match-any-of-my-field/89066/3 "2017-07-10T15:42:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.