# Template defining makes the elasticsearch slower
**URL:** https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306
**Category:** Elasticsearch
**Created:** [May 22, 2019, 6:57pm UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306 "2019-05-22T18:57:18Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [May 22, 2019, 6:57pm UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/1 "2019-05-22T18:57:18Z")
hi all,
when i start logstash without defining any templates, elasticsearch makes a template as following:
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [May 22, 2019, 6:58pm UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/2 "2019-05-22T18:58:13Z")
```
{
"test1" : {
"mappings" : {
"doc" : {
"properties" : {
"@timestamp" : {
"type" : "date"
},
"@version" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Br" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ClD" : {
"type" : "long"
},
"ClR" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ClS" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"CmdNo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"CmdStr" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Date" : {
"type" : "date"
},
"Date_Time" : {
"type" : "date"
},
"DPo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ExTi" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"KDate" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"KDate_Time" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
```
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [May 22, 2019, 6:58pm UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/3 "2019-05-22T18:58:41Z")
```
"PDur" : {
"type" : "long"
},
"PSe" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"QuWa" : {
"type" : "long"
},
"RspNo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"RspStr" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SRec" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SSe" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SSWa" : {
"type" : "long"
},
"SeSer" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SIP" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SPort" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"State" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"TCPS" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Terminal" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ThreadIdx" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Time" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"TrCo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"User" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"beat" : {
"type" : "object"
},
"fields" : {
"properties" : {
"log_type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"host" : {
"properties" : {
"architecture" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"id" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"os" : {
"properties" : {
"build" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"family" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"platform" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
},
"input" : {
"properties" : {
"type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"log" : {
"properties" : {
"file" : {
"properties" : {
"path" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
},
"offset" : {
"type" : "long"
},
"prospector" : {
"properties" : {
"type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"source" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"tags" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
}
}
```
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [May 22, 2019, 7:00pm UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/4 "2019-05-22T19:00:12Z")
based on the documentation, text field makes the indexing process slow, according this i defined a new template as following:
```
PUT _template/my_template1
{
"index_patterns" : [
"test2*"
],
"mappings" : {
"doc" : {
"properties" : {
"@timestamp" : {
"type" : "date"
},
"@version" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Br" : {
"type" : "integer"
},
"ClD" : {
"type" : "integer"
},
"ClR" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
} },
"ClS" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
} },
"CmdNo" : {
"type" : "keyword"
},
"CmdStr" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Date" : {
"type" : "date"
},
"Date_Time" : {
"type" : "date"
},
"DPo" : {
"type" : "integer"
},
"ExTi" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"KDate" : {
"type" : "keyword"
},
"KDate_Time" : {
"type" : "keyword"
},
```
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [May 22, 2019, 7:03pm UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/5 "2019-05-22T19:03:04Z")
```
"PDur" : {
"type" : "integer"
},
"PSe" : {
"type" : "keyword"
},
"QuWa" : {
"type" : "integer"
},
"RspNo" : {
"type" : "keyword"
},
"RspStr" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SRec" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
} },
"SSe" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
} },
"SSWa" : {
"type" : "integer"
},
"SeSer" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SIP" : {
"type" : "ip"
},
"SPort" : {
"type" : "integer"
},
"State" : {
"type" : "keyword"
},
"TCPS" : {
"type" : "integer"
},
"Terminal" : {
"type" : "keyword"
},
"ThreadIdx" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Time" : {
"type" : "keyword"
},
"TrCo" : {
"type" : "keyword"
},
"User" : {
"type" : "keyword"
},
"beat" : {
"type" : "object"
},
"fields" : {
"properties" : {
"log_type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"host" : {
"properties" : {
"architecture" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"id" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"os" : {
"properties" : {
"build" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"family" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"platform" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
},
"input" : {
"properties" : {
"type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"log" : {
"properties" : {
"file" : {
"properties" : {
"path" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
},
"offset" : {
"type" : "long"
},
"prospector" : {
"properties" : {
"type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"source" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"tags" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
}
```
but, defining the new template makes the elasticsearch indexing process slower, because using the first template ( the default one elasticsearch created automatically) indexed 500000 records in 30 minutes but the second template ( which i defined ) indexed 300000 records in 30 minutes. could you please advise me about this? how can i promote the templates to make the indexing process faster?
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [May 25, 2019, 6:36am UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/6 "2019-05-25T06:36:49Z")
is there anyone advise me about this?
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [May 25, 2019, 10:45am UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/7 "2019-05-25T10:45:33Z")
Could you get not the template but the final mapping for both indices and share it here?
If those are very big files, please share the content on [gist.github.com](http://gist.github.com) and just share the link here.
I don't see how this could be slower as there are less thing to do.
Also could you share a typical document you want to index?
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [May 29, 2019, 4:52am UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/8 "2019-05-29T04:52:00Z")
hi dadoonet
many thanks for your reply,
in the above comments, first one is the mapping of index which elasticsearch built itself; second one is a template which i define using dev tools of kibana, when i defined the template elasticsearch goes very very slower ,
please fine the mappings in the following link:
>
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [May 29, 2019, 5:27am UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/9 "2019-05-29T05:27:15Z")
please consider following example of data:
Br : 02923
CID : 1,058
CIR : 5/28/2019 10:59:59 PM
CIS : 5/28/2019 11:58:59 PM
CmdNo : 00089134587
CmdStr : 0008913458754681259876543215768768744766255
Date : 2019-05-28
Date\_Time : 2019-05-28T23:59:59.956+0430
DPo : 7009
ExTi : 0352489
KDate : 1398-02-29
KDate\_Time : 1398-02-29T23:59:59.956+0430
PDur : 4659
PSe : 00016589745202458594587
QuWa : 254
RspStr : 0259749+6588446555/2544465100121448/14455598555
SRec : 5/28/2019 10:59:59 PM
SSe : 5/28/2019 11:15:59 PM
SSWa : 1685
SIP : 192.169.05.15
SPort : 123456
State : 000000
TCPS : 26987452
Terminal : 0159
ThreadIdx : 12587+2598/2548+25/5846321
Time : 23:59:59.159
TrCo : 0236985147
User : 01265987324
beat :
and the others are for filebeat.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2019, 5:27am UTC](https://discuss.elastic.co/t/template-defining-makes-the-elasticsearch-slower/182306/10 "2019-06-26T05:27:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.