Unable to PUT _index_template which was captured from GET _index_template

Elastic Stack Elasticsearch
1

I am getting an index template as follows:

curl -X GET http://localhost:9200/_index_template/filebeat* > /var/tmp/filebeat-template.json

Now I want to PUT the same template into another elastic instance:

 curl http://localhost:9200/_index_template/filebeat  -H 'Content-Type: application/json' -d @/var/tmp/filebeat-template-formatted.json

However, it includes several fields which the API won't accept:

  "index_templates": [
    {
      "name":  filebeat-7.17.7",

I would like to do this as part of an automated process. Is there any solution other than parsing out the fields?

2

Please share the full error you are receiving.

3

I get the following:

{"error":{"root_cause":[{"type":"x_content_parse_exception","reason":"[1:2] [index_template] unknown field [index_templates] did you mean any of [index_patterns, template]?"}],"type":"x_content_parse_exception","reason":"[1:2] [index_template] unknown field [index_templates] did you mean any of [index_patterns, template]?"},"status":400}[

I got it working by parsing out the fields with jq:

cat metricbeat.json |jq -r '.index_templates[]' | jq -r '.index_template' > metricbeat-fixed.json
4

Yeah, the return of the GET _index_template will be an array in the index_templates field, this will return every template that matchs your get request, each item in the array will be an index template, so you need to parse as you did.

5

The solution is to strip out the fields as follows (using jq utility):

cat metricbeat.json |jq -r '.index_templates[]' | jq -r '.index_template' > metricbeat-fixed.json

The curl command then works as expected.