Why we need index template?

Why we need to create index template when we can simply define the fields and there datatype in the logstash itself using below syntax:
mutate {convert => ["field_name", "data_type"]

Because Elasticsearch will still map it dynamically, not statically.

Hi @warkolm ,
Sorry but I am not able to clearly understand!.

Even if you cast something in Logstash as, eg, a number, Elasticsearch might still map it as a string, or even the wrong kind of number type.

1 Like

Oh ok.
I tried loading a csv file data from logstash and the integer type fields got mapped properly from Logstash mutate plugin. Thats when I got this question of why we can't directly do the index mapping in logstash config itself.

Yep that will probably work, but it's not a guarantee unless it's using a mapping in Elasticsearch.

1 Like

Thanks for all the clarification :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.