Why isn't the template working inside logstash?

Elastic Stack Logstash
1

I'm using logstash 7.0.0.
I install my template but it doesn't apply.
Logs in logstash are print like this.

Attempting to install template {:manage_template=>{"template"=>"news*", "settings"=>{"index.refresh_interval"=>"5s", "analysis"=>{"tokenizer"=>{"nori_tokenizer"=>{"type"=>"nori_tokenizer"}}, "analyzer"=>{"nori_korean"=>{"type"=>"custom", "tokenizer"=>"nori_tokenizer"}}}}, "mappings"=>{"properties"=>{"body_text"=>{"type"=>"text", "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>32766}}}}}}}
[2021-01-21T05:33:38,239][INFO ][logstash.outputs.elasticsearch] Installing elasticsearch template to _template/crawled_news
[2021-01-21T05:33:38,358][INFO ][logstash.javapipeline    ] Pipeline started {"pipeline.id"=>"main"}
[2021-01-21T05:33:38,492][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2021-01-21T05:33:39,465][WARN ][logstash.outputs.elasticsearch] You are using a deprecated config setting "document_type" set in elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document types are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0. You should avoid this feature If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=>"document_type", :plugin=><LogStash::Outputs::ElasticSearch bulk_path=>"/_monitoring/bulk?system_id=logstash&system_api_version=7&interval=1s", hosts=>[http://elasticsearch:9200], sniffing=>false, manage_template=>false, id=>"7d7dfa0f023f65240aeb31ebb353da5a42dc782979a2bd7e26e28b7cbd509bb3", document_type=>"%{[@metadata][document_type]}", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_33539177-1d24-48eb-904b-90ffca932602", enable_metric=>true, charset=>"UTF-8">, workers=>1, template_name=>"logstash", template_overwrite=>false, doc_as_upsert=>false, script_type=>"inline", script_lang=>"painless", script_var_name=>"event", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, ilm_enabled=>"auto", ilm_rollover_alias=>"logstash", ilm_pattern=>"{now/d}-000001", ilm_policy=>"logstash-policy", action=>"index", ssl_certificate_verification=>true, sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false>}

As you can see, I installed above, but the attribute values ​​of template_name and manage_template are different below.

I have configured logstash.conf as below.

output {
    elasticsearch {
        hosts => ["elasticsearch:9200"]
        index => "news"
        document_id => "%{[@metadata][_id]}"
        manage_template => true
        template => "/usr/share/logstash/config-dir/mapping.json"
        template_name => "crawled_news"
        template_overwrite => true
    }
    stdout{
        codec => rubydebug { }   
    }
}

and then... template

{
  "template": "news*",
  "settings": {
    "index.refresh_interval": "5s",
    "analysis": {
      "tokenizer": {
        "nori_tokenizer": {
          "type": "nori_tokenizer"
        }
      },
      "analyzer": {
        "nori_korean": {
          "type": "custom",
          "tokenizer": "nori_tokenizer"
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "body_text": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 32766
          }
        }
      }
    }
  }
}

I tried logstash 7.1.0, but nothing changed.
Where am I making a mistake?

I'm sorry for my immature English

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.