Working with Index Templates

1. Understanding Template Types

Type Description Use Case Example

Index Template

Defines the structure and settings for indices

Setting up consistent index configurations across logs

Type	Description	Use Case	Example
Index Template	Defines the structure and settings for indices	Setting up consistent index configurations across logs	`{ "index_patterns": ["logs-*"], "settings": { "number_of_shards": 1, "number_of_replicas": 1 }, "mappings": { "properties": { "timestamp": { "type": "date" }, "message": { "type": "text" } } } }`
Composable Index Template	Allows combining multiple component templates into one index template	Modular configuration for complex index structures	`{ "index_patterns": ["app-*"], "composed_of": ["template-1", "template-2"], "priority": 100 }`
Component Template	Reusable building blocks for index templates	Shared settings and mappings across multiple index templates	`{ "name": "my-component-template", "template": { "settings": { "number_of_shards": 1 }, "mappings": { "properties": { "host": { "type": "keyword" } } } } }`

{
  "index_patterns": ["logs-*"],
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "timestamp": { "type": "date" },
      "message": { "type": "text" }
    }
  }
}

Composable Index Template

Allows combining multiple component templates into one index template

Modular configuration for complex index structures

{
  "index_patterns": ["app-*"],
  "composed_of": ["template-1", "template-2"],
  "priority": 100
}

Component Template

Reusable building blocks for index templates

Shared settings and mappings across multiple index templates

{
  "name": "my-component-template",
  "template": {
    "settings": {
      "number_of_shards": 1
    },
    "mappings": {
      "properties": {
        "host": { "type": "keyword" }
      }
    }
  }
}

2. Creating Index Templates

Example: Basic Index Template

{
  "index_patterns": ["logs-*"],
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  },
  "mapping": {
    "properties": {
      "timestamp": {
        "type": "date"
      },
      "message": {
        "type": "text"
      }
    }
  }
}

Field	Description	Values
index_patterns	Defines which indices this template applies to	`["logs-*"]`
settings	Index-level settings for matching indices	`{"number_of_shards": 1, "number_of_replicas": 1}`
mappings	Field mappings for the index	`{"properties": {"timestamp": {"type": "date"}}}`
priority	Template priority (higher values override lower)	`10`
composed_of	Composed templates (Elasticsearch 7.8+)	`["template-1"]`

Note: Index templates are applied when new indices are created or when existing indices match the pattern.

Warning: Templates with higher priority values will override templates with lower priorities.

Example: Template with Dynamic Mapping

{
  "index_patterns": ["app-logs-*"],
  "settings": {
    "number_of_shards": 2,
    "number_of_replicas": 0
  },
  "mapping": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "level": {
        "type": "keyword"
      }
    }
  }
}

3. Viewing Index Templates

Property	Description	Example
index_patterns	Defines the index patterns that this template applies to	`["logs-*"]`
settings	Index-level settings such as number of shards and replicas	`{ "number_of_shards": 1, "number_of_replicas": 1 }`
mappings	Field mappings and data types for the index	`{ "properties": { "timestamp": { "type": "date" } } }`
aliases	Index aliases to be applied when creating indices	`{ "logs": {} }`

Example: Retrieve Index Template

GET /_template/my_template

Example: List All Index Templates

GET /_template

Note: Index templates are applied automatically when new indices match the defined patterns.

4. Setting Template Priority

Property	Description	Values
priority	Determines the order in which templates are applied	`integer`

Note: Templates with higher priority values are applied first. If multiple templates match a given index, the one with the highest priority takes precedence.

Example: Setting Priority in Index Template

{
  "index_patterns": ["logs-*"],
  "priority": 100,
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  }
}

5. Using Component Templates

Property	Description	Example
component_template.name	Name of the component template	`"my_component_template"`
component_template.template	Template configuration object	`{ "index_patterns": ["logs-*"], "settings": { "number_of_shards": 1, "number_of_replicas": 1 } }`
component_template.composed_of	List of component template names to compose this template from	`["template_1", "template_2"]`

Example: Define a Component Template

{
  "name": "my_component_template",
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1
    },
    "mappings": {
      "properties": {
        "timestamp": {
          "type": "date"
        },
        "message": {
          "type": "text"
        }
      }
    }
  }
}

Note: Component templates are used to define reusable index configurations that can be composed into larger index templates.

6. Composing Templates

Example: Basic Index Template Structure

{
  "index_patterns": [
    "logs-*"
  ],
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  },
  "mapping": {
    "properties": {
      "timestamp": {
        "type": "date"
      },
      "message": {
        "type": "text"
      }
    }
  }
}

Field	Description	Usage
index_patterns	Defines which indices this template applies to	Required for all templates
settings	Index-level settings like shard count and replicas	Optional but commonly used
mappings	Defines field types and properties	Required for field structure
aliases	Defines aliases for indices matching this template	Optional, useful for alias management

Note: Templates are applied in order of pattern matching, with the most specific patterns taking precedence.

Example: Template with Alias and Settings

{
  "index_patterns": [
    "app-logs-*"
  ],
  "aliases": {
    "app-logs": {}
  },
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "refresh_interval": "30s"
  },
  "mapping": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "level": {
        "type": "keyword"
      },
      "message": {
        "type": "text"
      }
    }
  }
}

7. Updating Index Templates

Property	Description	Values	Notes
index_patterns	Defines the index patterns that this template applies to	`["logs-*"]`	Supports wildcards and regular expressions
settings	Index-level settings for the template	`{ "number_of_shards": 1, "number_of_replicas": 1 }`	Can include dynamic settings
mappings	Field mappings for the template	`{ "properties": { "timestamp": { "type": "date" } } }`	Supports dynamic templates
priority	Priority of the template (higher is preferred)	`100`	Defaults to 100 if not specified

Example: Update Index Template

{
  "index_patterns": ["logs-*"],
  "settings": {
    "number_of_shards": 2,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date"
      },
      "message": {
        "type": "text"
      }
    }
  },
  "priority": 200
}

Note: When updating an index template, existing indices that match the pattern will not automatically use the new settings. You must either close and reopen the indices or reindex them to apply the updated template.

8. Deleting Index Templates

Option	Values	Notes
template.name	`my-template`	Name of the index template to delete

Example: Delete Index Template

DELETE /_template/my-template

Note: The template must exist before attempting to delete it. If the template does not exist, the operation will return a 404 error.

9. Simulating Template Application

Simulating template application allows you to preview how an index template will be applied to indices without actually applying it. This is useful for testing and validation before deploying templates in production.

Action	Description	Command	Notes
Simulate template application	Preview how a template would be applied to an index	`GET /_index_template/_simulate_index/{index_name}`	Use this endpoint to test index templates before applying them

Example: Simulate Template Application

GET /_index_template/_simulate_index/my-index

Note: The response includes details about how the template would be applied, including matched patterns and applied settings.

10. Using Legacy Templates

Legacy templates in the ELK Stack are used for backward compatibility with older versions of Elasticsearch. These templates are defined using the template field and can be managed through the Elasticsearch API.

Field	Description	Example
template	Defines the index pattern for the template	`"template": "logstash-*"`
settings	Configuration settings for the index	`{ "number_of_shards": 1, "number_of_replicas": 1 }`
mappings	Defines the mapping for documents in the index	`{ "properties": { "timestamp": { "type": "date" } } }`

Example: Creating a Legacy Template

{
  "template": "logstash-*",
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  },
  "mappings": {
    "_doc": {
      "properties": {
        "timestamp": { "type": "date" },
        "message": { "type": "text" }
      }
    }
  }
}

Note: Legacy templates are deprecated in favor of index templates introduced in Elasticsearch 6.0. It is recommended to migrate to the new index template format for better functionality and support.