# Where do get filebeat.template-es6x.json

**URL:** <https://discuss.elastic.co/t/where-do-get-filebeat-template-es6x-json/117598>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 30, 2018, 10:04am UTC](https://discuss.elastic.co/t/where-do-get-filebeat-template-es6x-json/117598 "2018-01-30T10:04:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gaukharaya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaukharaya/32/27151_2.png) [@gaukharaya](https://discuss.elastic.co/u/gaukharaya)\
**Post date:** [January 30, 2018, 10:04am UTC](https://discuss.elastic.co/t/where-do-get-filebeat-template-es6x-json/117598/1 "2018-01-30T10:04:53Z")

</div>

I am having a similar issue as posted here:

> [@Filebeat v6 and elasticsearch v6](https://discuss.elastic.co/t/filebeat-v6-and-elasticsearch-v6/107925/7):
>
> Seems a better option is to have a dedicated template for filebeat 6.0.0 to avoid compatibility issues between 2 différent versions. And then voilà slight_smile

But my filebeat is running on windows.

The post suggests using filebeat.template-es6x.json. However I cannot find it my downloaded resource.  
I had to run a script to export a template even.

I am using filebeat 6.1.2 and elasticsearch 6.x. Using filebeat default configuration.

```auto
    filebeat.prospectors:
    - type: log
      enabled: true
      paths:
        - c:\path
    filebeat.config.modules:
      path: ${path.config}/modules.d/*.yml
      reload.enabled: false
    setup.template.settings:
      index.number_of_shards: 3
    setup.kibana:
      host: "kibana:5601"
    output.elasticsearch:
      hosts: ["elk:9200"]

```

The exact error is:

`WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]"}}`

\_template/filebeat returns this:  
[https://pastebin.com/Jb9bAxUS](https://pastebin.com/Jb9bAxUS)

\_template/filebeat-\*/\_mapping  
`{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"request [/_template/filebeat-*/_mapping] contains unrecognized parameter: [name]"}],"type":"illegal_argument_exception","reason":"request [/_template/filebeat-*/_mapping] contains unrecognized parameter: [name]"},"status":400}`

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 30, 2018, 2:40pm UTC](https://discuss.elastic.co/t/where-do-get-filebeat-template-es6x-json/117598/2 "2018-01-30T14:40:36Z")

</div>

The template.json files are gone with 6.0. Instead beats ships `fields.yml` file, with all fields being exported. This file is used to generate the template, matching the Elasticsearch version used. Running `filebeat export template --es.version <version>` will print a json template, compatible with the Elasticsearch version selected.

Did you upgrade from an older beats version? The type of the `error` field has been changed in 6.0 as well. Looks like an old template is still applied here.

Check all templates and delete old ones before restarting. You will need to delete todays index as well, as a template are only applied when indices are created.

---

<div class="post-metadata">

**Author:** ![gaukharaya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaukharaya/32/27151_2.png) [@gaukharaya](https://discuss.elastic.co/u/gaukharaya)\
**Post date:** [January 30, 2018, 2:46pm UTC](https://discuss.elastic.co/t/where-do-get-filebeat-template-es6x-json/117598/3 "2018-01-30T14:46:55Z")

</div>

Okay fixed. It was indeed the issue with old template as suggested in the quoted post.

Here are the steps taken:

1. Delete old template `Invoke-RestMethod -Method Delete "http://uks-elk-01-p:9200/filebeat-*"`
2. Delete old filebeat index in kibana
3. Export new template: `.\filebeat.exe export template --es.version 6.1.2 | Out-File -Encoding UTF8 filebeat.template.json`
4. Copy the new template over `Invoke-RestMethod -Method Put -ContentType "application/json" -InFile filebeat.template.json -Uri`[http://elk:9200/\_template/filebeat`](http://elk:9200/_template/filebeat%60)

Thanks everyone and the original quoted poster for helping fix this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2018, 2:47pm UTC](https://discuss.elastic.co/t/where-do-get-filebeat-template-es6x-json/117598/4 "2018-02-27T14:47:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.