Step 3: Loading the Index Template in Elasticsearch
editStep 3: Loading the Index Template in Elasticsearch
editBefore starting Topbeat, you need to load the index template, which lets Elasticsearch know which fields should be analyzed in which way.
The recommended template file is installed by the Topbeat packages. You can either configure Topbeat to load the template automatically, or you can run a shell command to load the template:
Configuring Topbeat to Load the Template
editTo configure Topbeat to load the template, you must enable the elasticsearch output. In the Topbeat configuration file, uncomment the template part under elasticsearch output. By default the template is named topbeat. Adjust the path to your template file.
output: elasticsearch: hosts: ["localhost:9200"] # A template is used to set the mapping in Elasticsearch # By default template loading is disabled and no template is loaded. # These settings can be adjusted to load your own template or overwrite existing ones template: # Template name. By default the template name is topbeat. #name: "topbeat" # Path to template file path: "topbeat.template.json" # Overwrite existing template #overwrite: false
The template is loaded when you start Topbeat. By default, if a template
already exists in the index, it is not overwritten. To overwrite an existing template,
set overwrite: true
in the configuration file.
Running a Shell Command to Load the Template
editYou can load the template by running the following command:
deb or rpm:
curl -XPUT 'http://localhost:9200/_template/topbeat' -d@/etc/topbeat/topbeat.template.json
mac:
cd topbeat-1.2.3-darwin curl -XPUT 'http://localhost:9200/_template/topbeat' -d@topbeat.template.json
win:
PS C:\Program Files\Topbeat> Invoke-WebRequest -Method Put -InFile topbeat.template.json -Uri http://localhost:9200/_template/topbeat?pretty
where localhost:9200
is the IP and port where Elasticsearch is listening.
If you’ve already used Topbeat to index data into Elasticsearch, the index may contain old documents. After you load the index template, you can delete the old documents from topbeat-* to force Kibana to look at the newest documents. Use this command:
curl -XDELETE 'http://localhost:9200/topbeat-*'