Step 4: Loading the Index Template in Elasticsearch

edit

Step 4: Loading the Index Template in Elasticsearch

edit

Before starting Filebeat, you need to load the index template, which lets Elasticsearch know which fields should be analyzed in which way.

The recommended template file is installed by the Filebeat packages. Load it with the following command:

deb or rpm:

curl -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@/etc/filebeat/filebeat.template.json

mac:

cd filebeat-1.1.2-darwin
curl -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@filebeat.template.json

win:

PS C:\Program Files\Filebeat> Invoke-WebRequest -Method Put -InFile filebeat.template.json -Uri http://localhost:9200/_template/filebeat?pretty

where localhost:9200 is the IP and port where Elasticsearch is listening.

If you’ve already used Filebeat to index data into Elasticsearch, the index may contain old documents. After you load the index template, you can delete the old documents from filebeat-* to force Kibana to look at the newest documents. Use this command: curl -XDELETE 'http://localhost:9200/filebeat-*'.