Updating template to include DocValue via api

Elastic Stack Logstash
1

I want to add DocValue to my default logstash-* template. I have seen documentation that says to add it to the raw section of the not_analyzed. But I don't have a config file on the server, so I will need to add this using the api. I haven't found any code for editing the index via a put statement, so I don't know the syntax to use. Can someone please share the syntax for updating a template? I am using this to view the template:

http://[eshostname]:smile: 9200/_template/logstash?pretty=true

2

The very first example in the index template documentation shows how to store an index template: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

Make sure you disable manage_template for your elasticsearch output.

3

So, do I just add a new index template? Or are you saying that if I use the same index name with the XPUT command (using the syntax from the first example) that it overwrite the existing template?

4

Yes, if the index template name in the URL matches an already existing index template it'll get overwritten by your PUT operation.

5

I was able to get my template updated, now I am wondering, how can I tell if docvalues are being applied to new indices. Is there a query I can run. Sorry if this a newbie question, but I can't find anything that shows how to tell if it is working or not. I want to make sure it is working correctly before I reindex the old data.