Where i can set index.codec value to best_compression

I have a working ELK stack and would like to enable index compression.

i want to set

index.codec : best_compression

but i have no idea how to do it and on which configuration file i need to add (is it in elasticsearch.yml or logstash.conf )

so that all my newly created indices will have best_compression .

Please help me solve it .

You use that when you create an index with the Create Index API: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html or within an index template: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

2 Likes

I just enrich the answer:

1) Using template

{
  "order": 100,
  "index_patterns": [
    "your-index-name"
  ],
  "settings": {
    "index": {
      "codec": "best_compression"
    }
  }
}

PUT your-index-name
GET /your-index-name?filter_path=**.codec

2) During creating an index

PUT /new-index-with-compression
{
  "settings": {
    "index": {
      "codec": "best_compression"
    }
  }
}

GET /new-index-with-compression?filter_path=**.codec
2 Likes

Thanks @vasek and @dadoonet for replying

but i getting the the following error :

{
"error": {
"root_cause": [
{
"type": "parse_exception",
"reason": "unknown key [logstash] in the template "
}
],
"type": "parse_exception",
"reason": "unknown key [logstash] in the template "
},
"status": 400
}

what i have done
Step 1 : Displaing my template

input in kinbana console :

GET /_template/logstash

ouput in kibana console :

{
"logstash" : {
"order" : 0,
"version" : 60001,
"index_patterns" : [
"logstash-"
],
"settings" : {
"index" : {
"refresh_interval" : "5s"
}
},
"mappings" : {
"default" : {
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"mapping" : {
"norms" : false,
"type" : "text"
},
"match_mapping_type" : "string"
}
},
{
"string_fields" : {
"mapping" : {
"norms" : false,
"type" : "text",
"fields" : {
"keyword" : {
"ignore_above" : 256,
"type" : "keyword"
}
}
},
"match_mapping_type" : "string",
"match" : "
"
}
}
],
"properties" : {
"@timestamp" : {
"type" : "date"
},
"geoip" : {
"dynamic" : true,
"properties" : {
"ip" : {
"type" : "ip"
},
"latitude" : {
"type" : "half_float"
},
"location" : {
"type" : "geo_point"
},
"longitude" : {
"type" : "half_float"
}
}
},
"@version" : {
"type" : "keyword"
}
}
}
},
"aliases" : { }
}
}

Step 2 : Editing my Template

by taking that output as input for my put operation (Added codec into that )

PUT /_template/logstash
{
"logstash" : {
"order" : 0,
"version" : 60001,
"index_patterns" : [
"logstash-"
],
"settings" : {
"index" : {
"refresh_interval" : "5s",
"codec":"best_compression"
}
},
"mappings" : {
"default" : {
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"mapping" : {
"norms" : false,
"type" : "text"
},
"match_mapping_type" : "string"
}
},
{
"string_fields" : {
"mapping" : {
"norms" : false,
"type" : "text",
"fields" : {
"keyword" : {
"ignore_above" : 256,
"type" : "keyword"
}
}
},
"match_mapping_type" : "string",
"match" : "
"
}
}
],
"properties" : {
"@timestamp" : {
"type" : "date"
},
"geoip" : {
"dynamic" : true,
"properties" : {
"ip" : {
"type" : "ip"
},
"latitude" : {
"type" : "half_float"
},
"location" : {
"type" : "geo_point"
},
"longitude" : {
"type" : "half_float"
}
}
},
"@version" : {
"type" : "keyword"
}
}
}
},
"aliases" : { }
}
}

output :

{
"error": {
"root_cause": [
{
"type": "parse_exception",
"reason": "unknown key [logstash] in the template "
}
],
"type": "parse_exception",
"reason": "unknown key [logstash] in the template "
},
"status": 400
}

Please help me solve it

Look at the output again. There is written: unknown key logstash. @dadoonet posted nice tutorial how to define ES template.

  • one remark:
    I can see logstash- in index patterns.. is it really right? What about logstash* or logstash-*?

Try to define very simple template first. Step by step...

You can edit or create your Index templates in Cerebro if you can. The Cerebro has a syntax checker and you can easily read another templates.
There is tutorial how to install Cerebro.

Or try to edit template in Kibana - Dev Tools - Console.

thanks @vasek the @dadoonet tutorial helped
i have made few syntax errors .

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.