Elasticsearch Index Templates

Index templates allow you to specify index settings and mappings that will automatically be applied when an index is first created. It uses a simple pattern match to control when a template is applied. An index can have multiple patterns applied by using the order key.

The best way to show how an Index Template works is by example. I’ll start with the Logstash Default Template. Then, I’ll override some existing settings and add some new settings in a new Index Template.

The Logstash Default Template that is added to Elasticsearch the first time Logstash connects to an Elasticsearch Cluster.

The default of “settings.index.number_of_shards“: “1” is too few shards for most applications. This Curl command will create a new Index Pattern that will override the default settings. It will only affect indexes starting with logstash-.

curl -H 'Content-Type: application/json' -XPUT esnode:9200/_template/default-shards -d '{
  "index_patterns": ["logstash-*"], 
  "order": 10, 
  "settings": {
    "index": { 
      "number_of_shards": "3" 
    }
  }
}'

Here is what the new Index Template looks like.

GET /_template/default-shards
{
  "default-shards": {
    "order": 10,
    "index_patterns": [
      "logstash-*"
    ],
    "settings": {
      "index": {
        "number_of_shards": "3"
      }
    },
    "mappings": {},
    "aliases": {}
  }
}

You can also update the Index Mapping with an Index Template. I’ll enforce a mapping for indices where the _source field can be disabled, fields that are commonly mistyped like integers or need a different precision in the case of doubles and floats.

PUT _template/logstash-datatypes
{
  "index_patterns": ["logstash-*"],
  "mappings": {
    "_source": {
      "enabled": false
    },
    "properties": {
      "status": {
        "type": "integer"
      }
    }
  }
}