Index templates
editIndex templates
editThis topic describes the composable index templates introduced in Elasticsearch 7.8. For information about how index templates worked previously, see the legacy template documentation.
An index template is a way to tell Elasticsearch how to configure an index when it is created. For data streams, the index template configures the stream’s backing indices as they are created. Templates are configured prior to index creation and then when an index is created either manually or through indexing a document, the template settings are used as a basis for creating the index.
There are two types of templates, index templates and component templates. Component templates are reusable building blocks that configure mappings, settings, and aliases. You use component templates to construct index templates, they aren’t directly applied to a set of indices. Index templates can contain a collection of component templates, as well as directly specify settings, mappings, and aliases.
If a new data stream or index matches more than one index template, the index template with the highest priority is used.
Elasticsearch has built-in index templates, each with a priority of 100
, for the
following index patterns:
-
logs-*-*
-
metrics-*-*
-
synthetics-*-*
Elastic Agent uses these templates to create
data streams. If you use the Elastic Agent, assign your index templates a priority
lower than 100
to avoid overriding the built-in templates.Otherwise, to avoid
accidentally applying the built-in templates, do one or more of the following:
-
To disable all built-in index and component templates, set
stack.templates.enabled
tofalse
inelasticsearch.yml
. - Use a non-overlapping index pattern.
-
Assign templates with an overlapping pattern a
priority
higher than100
. For example, if you don’t use the Elastic Agent and want to create a template for thelogs-*
index pattern, assign your template a priority of200
. This ensures your template is applied instead of the built-in template forlogs-*-*
.
When a composable template matches a given index it always takes precedence over a legacy template. If no composable template matches, a legacy template may still match and be applied.
If an index is created with explicit settings and also matches an index template, the settings from the create index request take precedence over settings specified in the index template and its component templates.
PUT _component_template/component_template1 { "template": { "mappings": { "properties": { "@timestamp": { "type": "date" } } } } } PUT _component_template/other_component_template { "template": { "mappings": { "properties": { "ip_address": { "type": "ip" } } } } } PUT _index_template/template_1 { "index_patterns": ["te*", "bar*"], "template": { "settings": { "number_of_shards": 1 }, "mappings": { "properties": { "host_name": { "type": "keyword" }, "created_at": { "type": "date", "format": "EEE MMM dd HH:mm:ss Z yyyy" } } }, "aliases": { "mydata": { } } }, "priority": 200, "composed_of": ["component_template1", "other_component_template"], "version": 3, "_meta": { "description": "my custom" } }