WARNING: Version 5.5 of Metricbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Step 3: Loading the Index Template in Elasticsearch
editStep 3: Loading the Index Template in Elasticsearch
editIn Elasticsearch, index templates are used to define settings and mappings that determine how fields should be analyzed.
The recommended index template file for Metricbeat is installed by the Metricbeat packages. If you accept
the default configuration for template loading in the metricbeat.yml
config file,
Metricbeat loads the template automatically after successfully connecting to Elasticsearch. If the template
already exists, it’s not overwritten unless you configure Metricbeat to do so.
If you want to disable automatic template loading, or you want to load your own template, you can change the settings for template loading in the Metricbeat configuration file. If you choose to disable automatic template loading, you need to load the template manually. For more information, see:
- Configuring Template Loading - supported for Elasticsearch output only
- Loading the Template Manually - required for Logstash output
Configuring Template Loading
editBy default, Metricbeat automatically loads the recommended template file, metricbeat.template.json
,
if Elasticsearch output is enabled. You can configure metricbeat to load a different template
by adjusting the template.name
and template.path
options in metricbeat.yml
file:
output.elasticsearch: hosts: ["localhost:9200"] template.name: "metricbeat" template.path: "metricbeat.template.json" template.overwrite: false
By default, if a template already exists in the index, it is not overwritten. To overwrite an existing
template, set template.overwrite: true
in the configuration file.
To disable automatic template loading, comment out the template part under the Elasticsearch output.
The options for auto loading the template are not supported if you are using the Logstash output.
Loading the Template Manually
editIf you disable automatic template loading, you need to run the following command to load the template:
deb or rpm:
curl -H 'Content-Type: application/json' -XPUT 'http://localhost:9200/_template/metricbeat' -d@/etc/metricbeat/metricbeat.template.json
mac:
cd metricbeat-5.5.3-darwin-x86_64 curl -H 'Content-Type: application/json' -XPUT 'http://localhost:9200/_template/metricbeat' -d@metricbeat.template.json
docker:
docker run --rm docker.elastic.co/beats/metricbeat:5.5.3 curl -H 'Content-Type: application/json' -XPUT 'http://localhost:9200/_template/metricbeat' -d@metricbeat.template.json
win:
PS C:\Program Files\Metricbeat> Invoke-WebRequest -Method Put -InFile metricbeat.template.json -Uri http://localhost:9200/_template/metricbeat?pretty -ContentType application/json
where localhost:9200
is the IP and port where Elasticsearch is listening.
If you’ve already used Metricbeat to index data into Elasticsearch, the index may contain old documents. After you load the index template, you can delete the old documents from metricbeat-* to force Kibana to look at the newest documents. Use this command:
curl -XDELETE 'http://localhost:9200/metricbeat-*'