Step 3: Loading the Index Template in Elasticsearch

In Elasticsearch, index templates are used to define settings and mappings that determine how fields should be analyzed.

The recommended template file is installed by the Topbeat packages. You can either configure Topbeat to load the template automatically, or you can load the template manually.

Configuring Template Loading - supported for Elasticsearch output only
Loading the Template Manually - required for Logstash output

Configuring Template Loading

edit

To configure Topbeat to load the template, you must enable the Elasticsearch output. In the Topbeat configuration file, uncomment the template part under elasticsearch section. By default the template is named topbeat. Adjust the path to your template file.

output:
  elasticsearch:
    hosts: ["localhost:9200"]

    # A template is used to set the mapping in Elasticsearch
    # By default template loading is disabled and no template is loaded.
    # These settings can be adjusted to load your own template or overwrite existing ones
    template:

      # Template name. By default the template name is topbeat.
      #name: "topbeat"

      # Path to template file
      path: "topbeat.template.json"

      # Overwrite existing template
      #overwrite: false

The template is loaded when you start Topbeat. By default, if a template already exists in the index, it is not overwritten. To overwrite an existing template, set overwrite: true in the configuration file.

The options for auto loading the template are not supported if you are using the Logstash output.

Loading the Template Manually

edit

You can load the template by running the following command:

deb or rpm:

curl -XPUT 'http://localhost:9200/_template/topbeat' -d@/etc/topbeat/topbeat.template.json

mac:

cd topbeat-1.3.1-darwin
curl -XPUT 'http://localhost:9200/_template/topbeat' -d@topbeat.template.json

win:

PS C:\Program Files\Topbeat> Invoke-WebRequest -Method Put -InFile topbeat.template.json -Uri http://localhost:9200/_template/topbeat?pretty

where localhost:9200 is the IP and port where Elasticsearch is listening.

If you’ve already used Topbeat to index data into Elasticsearch, the index may contain old documents. After you load the index template, you can delete the old documents from topbeat-* to force Kibana to look at the newest documents. Use this command:

curl -XDELETE 'http://localhost:9200/topbeat-*'

« Step 2: Configuring Topbeat Step 4: Starting Topbeat »