"Validation Failed: 1: template is missing;

I am new to ELK, I am copying existing logstash-* template and making new one with an other name. After changing template name when i PUT template back it give me following error

I am using ELK 5.1.1

curl -XPUT localhost:9200/_template/example.com?pretty -d @logstash.json
{
"example.com" : {
"order" : 0,
"version" : 50001,
"template" : "example.com-",
"settings" : {
"index" : {
"refresh_interval" : "5s"
}
},
"mappings" : {
"default" : {
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"mapping" : {
"norms" : false,
"type" : "text"
},
"match_mapping_type" : "string"
}
},
{
"string_fields" : {
"mapping" : {
"norms" : false,
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"match_mapping_type" : "string",
"match" : "
"
}
}
],
"_all" : {
"norms" : false,
"enabled" : true
},
"properties" : {
"@timestamp" : {
"include_in_all" : false,
"type" : "date"
},
"geoip" : {
"dynamic" : true,
"properties" : {
"ip" : {
"type" : "ip"
},
"latitude" : {
"type" : "half_float"
},
"location" : {
"type" : "geo_point"
},
"longitude" : {
"type" : "half_float"
}
}
},
"@version" : {
"include_in_all" : false,
"type" : "keyword"
}
}
}
},
"aliases" : { }
}
}

Error

{
"error" : {
"root_cause" : [
{
"type" : "action_request_validation_exception",
"reason" : "Validation Failed: 1: template is missing;"
}
],
"type" : "action_request_validation_exception",
"reason" : "Validation Failed: 1: template is missing;"
},
"status" : 400
}

Hey,

please use proper formatting in your messages. This is pretty hard to read.

When you compare your JSON with the one mentioned in the documentation, you will notice, that yours is missing a field called template, which defines the indices this template should be assigned to. That's what is meant with the failed validation.

--Alex

Thanks I have removed this part that fixed the issue

<
{
"example.com" : {
"order" : 0,
"version" : 50001,
/>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.