Use default longstash template for custom index pattern

Elastic Stack Elasticsearch
1

Hello!

I've recently realized, that elasticsearch uses templates that tells which types should map to variables. As far as I know without any configuration elasticsearch only uses a default template for the logstash-%{+YYYY.MM.dd} index pattern.

However I'd like to use a custom index pattern (app_live-%{+YYYY.MM.dd}). Unfortunately in this case elasticsearch doesn't map the geoip.location to geo_point which is needed for showing them on map. It works well if I change to default logstash-%{+YYYY.MM.dd} pattern. Therefore the mentioned default one would be sufficient.

So my question is, how can I force elasticsearch to use the default template for this custom index pattern? If it's not possible, then what would be the legal way to solve this problem?

Thanks in advance!
Soma

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.