# Template Problems

**URL:** <https://discuss.elastic.co/t/template-problems/86909>\
**Category:** Elasticsearch\
**Created:** [May 24, 2017, 7:13am UTC](https://discuss.elastic.co/t/template-problems/86909 "2017-05-24T07:13:42Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![uschellh](https://avatars.discourse-cdn.com/v4/letter/u/65b543/32.png) [@uschellh](https://discuss.elastic.co/u/uschellh)\
**Post date:** [May 24, 2017, 7:13am UTC](https://discuss.elastic.co/t/template-problems/86909/1 "2017-05-24T07:13:42Z")

</div>

Hello there, we are playing arround with elasticsearch and logstash, and i want to change the index template for having more indexed at once:

basically we need that in the template:  
curl -XPUT 'localhost:9200/OURINDEX/\_settings' -d '  
{  
"index.mapping.total\_fields.limit": 3000  
}'

i failed so far, and wonder what i did wrong, i have seen  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html)  
and for example this:  
[https://github.com/Icinga/icingabeat/blob/master/vendor/github.com/elastic/beats/filebeat/filebeat.template.json](https://github.com/Icinga/icingabeat/blob/master/vendor/github.com/elastic/beats/filebeat/filebeat.template.json)

this is our actual template:  
/etc/logstash# curl -XGET '[bacchus.sit.fraunhofer.de:9200/\_template/logstash](http://bacchus.sit.fraunhofer.de:9200/_template/logstash)'

{"logstash":{"order":0,"template":"logstash-_","settings":{"index":{"refresh\_interval":"5s"}},"mappings":{"default":{"dynamic\_templates":[{"message\_field":{"mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit\_norms":true,"type":"string"},"match\_mapping\_type":"string","match":"message"}},{"string\_fields":{"mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit\_norms":true,"type":"string","fields":{"raw":{"ignore\_above":256,"index":"not\_analyzed","type":"string"}}},"match\_mapping\_type":"string","match":"_"}}],"\_all":{"omit\_norms":true,"enabled":true},"properties":{"@timestamp":{"type":"date"},"geoip":{"dynamic":true,"properties":{"ip":{"type":"ip"},"latitude":{"type":"float"},"location":{"type":"geo\_point"},"longitude":{"type":"float"}}},"@version":{"index":"not\_analyzed","type":"string"}}}},"aliases":{}}}

i tried putting the updated with different syntax etc but it would not let me

for example this one :  
{"template":"logstash-_","settings":{"index":{"mapping":{"total\_fields":{"limit":"3000"}},"refresh\_interval":"5s"}},"mappings":{"default":{"dynamic\_templates":[{"message\_field":{"mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit\_norms":true,"type":"string"},"match\_mapping\_type":"string","match":"message"}},{"string\_fields":{"mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit\_norms":true,"type":"string","fields":{"raw":{"ignore\_above":256,"index":"not\_analyzed","type":"string"}}},"match\_mapping\_type":"string","match":"_"}}],"\_all":{"omit\_norms":true,"enabled":true},"properties":{"@timestamp":{"type":"date"},"geoip":{"dynamic":true,"properties":{"ip":{"type":"ip"},"latitude":{"type":"float"},"location":{"type":"geo\_point"},"longitude":{"type":"float"}}},"@version":{"index":"not\_analyzed","type":"string"}}}},"aliases":{}}}

what would be the correct syntax ? i didnt find examples ? can you name some tools which mape it more human friendly like the .json examples i found maybe ?

thanks for input

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 24, 2017, 8:56am UTC](https://discuss.elastic.co/t/template-problems/86909/2 "2017-05-24T08:56:36Z")

</div>

> [@uschellh](#):
>
> i tried putting the updated with different syntax etc but it would not let me

Why not? Was there an error, what was the error?

---

<div class="post-metadata">

**Author:** ![uschellh](https://avatars.discourse-cdn.com/v4/letter/u/65b543/32.png) [@uschellh](https://discuss.elastic.co/u/uschellh)\
**Post date:** [May 24, 2017, 10:04am UTC](https://discuss.elastic.co/t/template-problems/86909/3 "2017-05-24T10:04:27Z")

</div>

Hello,

yes in this case here i put the "upload" into a file and got:  
curl -XPUT '[http://localhost:9200/\_template/logstash](http://localhost:9200/_template/logstash)' -d@/home/sitadm/indices\_mapping.sh  
{"error":{"root\_cause":[{"type":"not\_x\_content\_exception","reason":"Compressor detection can only be called on some xcontent bytes or compressed xcontent bytes"}],"type":"not\_x\_content\_exception","reason":"Compressor detection can only be called on some xcontent bytes or compressed xcontent bytes"},"status":500}

as i was putting it in a line i got:

{"error":{"root\_cause":[{"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: template is missing;"}],"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: template is missing;"},"status":400}

for reference, here is the content of the last try:

curl -XPUT '[http://localhost:9200/\_template/logstash](http://localhost:9200/_template/logstash)' -d@/home/sitadm/logstash.json  
{"error":{"root\_cause":[{"type":"not\_x\_content\_exception","reason":"Compressor detection can only be called on some xcontent bytes or compressed xcontent bytes"}],"type":"not\_x\_content\_exception","reason":"Compressor detection can only be called on some xcontent bytes or compressed xcontent bytes"},"status":500}

content: (i added PUT \_template/logstash copared to another try, i moved "template":"logstash-\*"} to the bottom )

* * *

PUT \_template/logstash  
{  
"settings":{  
"index":{  
"mapping":{  
"total\_fields":{  
"limit":"3000"  
}  
},  
"refresh\_interval":"5s"  
}  
},  
"mappings":{  
"_default_":{  
"dynamic\_templates":[  
{  
"message\_field":{  
"mapping":{  
"fielddata":{  
"format":"disabled"  
},  
"index":"analyzed","omit\_norms":true,"type":"string"  
},  
"match\_mapping\_type":"string","match":"message"  
}  
},  
{  
"string\_fields":{  
"mapping":{  
"fielddata":{  
"format":"disabled"  
},  
"index":"analyzed","omit\_norms":true,"type":"string","fields":{  
"raw":{  
"ignore\_above":256,"index":"not\_analyzed","type":"string"  
}  
}  
},  
"match\_mapping\_type":"string","match":"_"  
}  
}  
],  
"\_all":{  
"omit\_norms":true,"enabled":true  
},  
"properties":{  
"@timestamp":{  
"type":"date"  
},  
"geoip":{  
"dynamic":true,"properties":{  
"ip":{  
"type":"ip"  
},  
"latitude":{  
"type":"float"  
},  
"location":{  
"type":"geo\_point"  
},  
"longitude":{  
"type":"float"  
}  
}  
},  
"@version":{  
"index":"not\_analyzed","type":"string"  
}  
}  
}  
},  
"aliases":{  
},  
"template":"logstash-_"}

---

<div class="post-metadata">

**Author:** ![uschellh](https://avatars.discourse-cdn.com/v4/letter/u/65b543/32.png) [@uschellh](https://discuss.elastic.co/u/uschellh)\
**Post date:** [May 26, 2017, 7:18am UTC](https://discuss.elastic.co/t/template-problems/86909/4 "2017-05-26T07:18:08Z")

</div>

please, that must be something obvious or easy i am missing ?!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 26, 2017, 8:35am UTC](https://discuss.elastic.co/t/template-problems/86909/5 "2017-05-26T08:35:24Z")

</div>

I just tested that on 5.4.0 using dev tools and it worked fine, so your syntax seems to be good 🙂

---

<div class="post-metadata">

**Author:** ![uschellh](https://avatars.discourse-cdn.com/v4/letter/u/65b543/32.png) [@uschellh](https://discuss.elastic.co/u/uschellh)\
**Post date:** [May 26, 2017, 9:23am UTC](https://discuss.elastic.co/t/template-problems/86909/6 "2017-05-26T09:23:45Z")

</div>

thanks , i googled a bit about

> <https://github.com/elastic/elasticsearch-rails/issues/606>

and just removed the first Line:

PUT \_template/logstash

i guess i could have changed the curl command instead, but it seems to have eaten it !

Have a nice day and thanks alot again

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 26, 2017, 9:24am UTC](https://discuss.elastic.co/t/template-problems/86909/7 "2017-05-26T09:24:25Z")

</div>

Oh, I didn't realise that first line was in the file.  
You need that for Console, but not curl 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 23, 2017, 9:24am UTC](https://discuss.elastic.co/t/template-problems/86909/8 "2017-06-23T09:24:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.