What is an Elasticsearch index template?

Index templates define settings and mappings that you can automatically apply when creating new indices. Elasticsearch applies templates to new indices based on an index pattern that matches the index name.

Index templates are only applied during index creation. Changes to index templates do not affect existing indices. Settings and mappings specified in create index API requests override any settings or mappings specified in an index template.

How can I view the current templates?

There are two ways you can view the current index templates on your Logit ELK Stacks.

1. Using Kibana Dev tools

One way is to use dev tools in Kibana. You can access Kibana from any of your dashboards by clicking the ‘Launch Kibana’ button.
Once Kibana has opened you need to open Kibana Dev Tools by click on the wrench icon in the left hand menu.

In the console section of the screen we are going to enter the following command.

GET _template

You should get an output similar to that of the screenshot below. Here you can see all the index templates currently used on this Elasticsearch instance.

You can also search for a specific template. For example if we wanted to see the template for the filebeat-* index pattern we can run the following command to return only the desired template. We have used a wildcard expression below to return any template that contains filebeat-'wildcard'.

GET _template/filebeat-*

This will return a json output similar to the screenshot below. Here you can see the following.

  • The index template name = filebeat-7.7
  • The order of the template = 1
  • The index pattern this template applies to = filebeat-*

2. Using the Template Index API

The second way to review the index templates currently in use is to use the index template API. To do this you will need your Elasticsearch endpoint address and your ApiKey. These can be accessed from your dashboard by choosing Stack Settings > Elasticsearch.

The next step is to write a a curl -x get command to retrieve the mappings from Elasticsearch. In your terminal window you can run a command similar to the below.

curl -X GET https://<your-stack-ID>-es.logit.io/_template/?apikey=<your-stack-ApiKey>&pretty

This will return a json output similar to the screenshot below.

Similar to using Kibana Dev Tools you can also search for a specific template using the index template API.

To do this you can run a command similar to the below remembering to substitute in your stack ID and stack ApiKey.

curl -X GET https://<Your-stack-ID>-es.logit.io/_template/filebeat-*/?apikey=<your-stack-ApiKey>&pretty

By adding the 'filebeat-*/ ' to the command we can search for only the index templates that contains filebeat-*.

What's next?

Did this answer your question?