# Template with order 1 not applied

**URL:** https://discuss.elastic.co/t/template-with-order-1-not-applied/70799
**Category:** Elasticsearch
**Created:** [January 6, 2017, 4:35pm UTC](https://discuss.elastic.co/t/template-with-order-1-not-applied/70799 "2017-01-06T16:35:28Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Melpheos](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Melpheos](https://discuss.elastic.co/u/Melpheos)
#### Post date: [January 6, 2017, 4:35pm UTC](https://discuss.elastic.co/t/template-with-order-1-not-applied/70799/1 "2017-01-06T16:35:28Z")

</div>

I am desesperatly trying to get elasticsearch indexing some field in geo\_point format but my template is ignored  
Data comes from our fortigate firewall and i'm receiving all the geoip information properly in elasticsearch as expected but \*.location is not indexed as geo\_point

I'm using the following template and according to the documentation it should be applied last

> [@](#):
>
> "logstash": {  
> "order": 1,  
> "template": "logstash-\*",  
> "settings": {},  
> "mappings": {  
> "tran\_geoip": {  
> "properties": {  
> "location": {  
> "type": "geo\_point"  
> }  
> }  
> },  
> "dst\_geoip": {  
> "properties": {  
> "location": {  
> "type": "geo\_point"  
> }  
> }  
> },  
> "src\_geoip": {  
> "properties": {  
> "location": {  
> "type": "geo\_point"  
> }  
> }  
> }  
> },  
> "aliases": {}  
> }  
> }

As you can see there is nothing special about it and it should apply to all index with logstash-\* but that's not the case. I have tried with template: "\*" with the same result.  
I have also tried to add _default_ but then the PUT command gets lots of error and can't parse it.  
We are using the latest version of logstash/ES.

If anyone has an idea of what i'm doing wrong but i'm struggling with that for days now without any progress :-/

---

<div class="post-metadata">

### Author: ![Melpheos](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@Melpheos](https://discuss.elastic.co/u/Melpheos)
#### Post date: [January 9, 2017, 12:45pm UTC](https://discuss.elastic.co/t/template-with-order-1-not-applied/70799/2 "2017-01-09T12:45:47Z")

</div>

Finaly managed to have it working as i wish and i now have the proper mapping working.  
For some reason the mapping would not apply so i had to create a new \_template with the following

{  
"logstash-_": {  
"order": 0,  
"version": 50001,  
"template": "logstash-_",  
"settings": {  
"index": {  
"refresh\_interval": "5s"  
}  
},  
"mappings": {  
"_default_": {  
"dynamic\_templates": [  
{  
"message\_field": {  
"path\_match": "message",  
"mapping": {  
"norms": false,  
"type": "text"  
},  
"match\_mapping\_type": "string"  
}  
},  
{  
"string\_fields": {  
"mapping": {  
"norms": false,  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword"  
}  
}  
},  
"match\_mapping\_type": "string",  
"match": "\*"  
}  
}  
],  
"\_all": {  
"norms": false,  
"enabled": true  
},  
"properties": {  
"tra\_geoip": {  
"dynamic": true,  
"properties": {  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
}  
}  
},  
"dst\_geoip": {  
"dynamic": true,  
"properties": {  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
}  
}  
},  
"@timestamp": {  
"include\_in\_all": false,  
"type": "date"  
},  
"geoip": {  
"dynamic": true,  
"properties": {  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
}  
}  
},  
"@version": {  
"include\_in\_all": false,  
"type": "keyword"  
},  
"src\_geoip": {  
"dynamic": true,  
"properties": {  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
}  
}  
}  
}  
}  
},  
"aliases": {}  
}  
}

Request can be closed. Hope this will help some people

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 6, 2017, 12:46pm UTC](https://discuss.elastic.co/t/template-with-order-1-not-applied/70799/3 "2017-02-06T12:46:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
