# Wrong ElasticSearch template being used **URL:** \ **Category:** Logstash\ **Created:** [October 8, 2015, 1:21am UTC](https://discuss.elastic.co/t/wrong-elasticsearch-template-being-used/31812 "2015-10-08T01:21:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Dualnames](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dualnames/32/5221_2.png) [@Dualnames](https://discuss.elastic.co/u/Dualnames)\ **Post date:** [October 8, 2015, 1:21am UTC](https://discuss.elastic.co/t/wrong-elasticsearch-template-being-used/31812/1 "2015-10-08T01:21:02Z")
I am not sure if this is the correct forum for this but I am having issues with one of my logstash configurations when it is sent to elasticsearch. I am brand new to ELK and still learning how everything works. So far, I have 2 logstash configurations setup, one is for NetFlow data and the other is for local logs (I am also using packetbeat but I don't think that is related). So, the NetFlow template works great for the NetFlow data but my issue is that when I send the local logs to Elasticsearch, it is trying to use the NetFlow template for the local logs aswell. I am testing this with CentOS on /var/log/messages so it is typical syslog messages. I tried setting up a Grok filter but I don't even know if that is necessary (also it didn't help). Below is my configurations: Local logs (syslog) > [@](#): > > input { > file { > path =\> "/var/log/messages" > type =\> "messages" > start\_position =\> "beginning" > } > } > > filter { > if [type] =~ "messages" { > grok { > match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{SYSLOGHOST:host}%{SPACE}%{SYSLOGPROG:program}%{GREEDYDATA:message}" } > } > } > } > > output { > elasticsearch { > index =\> "locallogs-%{+YYYY.MM.dd}" > host =\> "localhost" > template =\> "/opt/logstash/elasticsearch-template.json" > template\_overwrite =\> true > } > } NetFlow > [@](#): > > input { > udp { > codec =\> netflow > port =\> 9996 > } > } > output { > elasticsearch { > index =\> "logstash-%{+YYYY.MM.dd}" > host =\> "localhost" > } > } My templates wouldn't fit into the body: [http://coriewhite.me/elasticsearchtemplates.html](http://coriewhite.me/elasticsearchtemplates.html) Please let me know if you guys need any further information and thank you in advanced for the help! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 8, 2015, 1:29am UTC](https://discuss.elastic.co/t/wrong-elasticsearch-template-being-used/31812/2 "2015-10-08T01:29:46Z")
How are you defining the Netflow template? Also are you merging these configs? ---
**Author:** ![Dualnames](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dualnames/32/5221_2.png) [@Dualnames](https://discuss.elastic.co/u/Dualnames)\ **Post date:** [October 8, 2015, 1:33am UTC](https://discuss.elastic.co/t/wrong-elasticsearch-template-being-used/31812/3 "2015-10-08T01:33:48Z")
Well, the configs are in separate files: > [@](#): > > [root@localhost conf.d]# pwd > /etc/logstash/conf.d > [root@localhost conf.d]# ll > total 8 > -rw-r--r--. 1 root root 501 Oct 7 20:40 01-logstash-syslog.conf > -rw-r--r--. 1 root root 156 Oct 7 00:00 logstash-staticfile-netflow.conf Not sure what you mean by defining NetFlow template but it's under the \_templates like so: curl -XGET localhost:9200/\_template/logstash\_netflow5?pretty ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 8, 2015, 1:35am UTC](https://discuss.elastic.co/t/wrong-elasticsearch-template-being-used/31812/4 "2015-10-08T01:35:24Z")
Even though these are different files, they get merged by LS at run time. So you need to add a conditional to the output to make sure each message goes to it's correct config. ---
**Author:** ![Dualnames](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dualnames/32/5221_2.png) [@Dualnames](https://discuss.elastic.co/u/Dualnames)\ **Post date:** [October 8, 2015, 1:38am UTC](https://discuss.elastic.co/t/wrong-elasticsearch-template-being-used/31812/5 "2015-10-08T01:38:26Z")
Oo thank you! Sounds like you know what's going on. Er, do you have an example on how to do this though or a link related to this? This is my Kibana results: [http://coriewhite.me/locallog.png](http://coriewhite.me/locallog.png) ---
**Author:** ![Dualnames](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dualnames/32/5221_2.png) [@Dualnames](https://discuss.elastic.co/u/Dualnames)\ **Post date:** [October 8, 2015, 2:19am UTC](https://discuss.elastic.co/t/wrong-elasticsearch-template-being-used/31812/6 "2015-10-08T02:19:46Z")
I got it working! Thanks! > [@](#): > > input { > file { > path =\> "/var/log/messages" > type =\> "messages" > start\_position =\> "beginning" > } > } > > filter { > if [type] =~ "messages" { > grok { > match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{SYSLOGHOST:host}%{SPACE}%{SYSLOGPROG:program}%{GREEDYDATA:message}" } > } > } > } > > output { > if [type] == "messages" { > elasticsearch { > index =\> "locallogs-%{+YYYY.MM.dd}" > host =\> "localhost" > template\_name =\> "logstash" > } > } > } > [@](#): > > input { > udp { > codec =\> netflow > port =\> 9996 > type =\> "netflow" > } > } > output { > if [type] == "netflow" { > elasticsearch { > index =\> "logstash-%{+YYYY.MM.dd}" > host =\> "localhost" > template\_name =\> "logstash\_netflow5" > } > } > } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:27am UTC](https://discuss.elastic.co/t/wrong-elasticsearch-template-being-used/31812/7 "2017-07-06T05:27:10Z")
Closed on July 6, 2017, 5:27am UTC