How to set an Elasticsearch output template in Logstash How to set an Elasticsearch output template in Logstash elasticsearch elasticsearch

How to set an Elasticsearch output template in Logstash


The problem is that you have set manage_template to false, which completely disables this template creation feature and requires you to create the template manually like you're doing right now.

So your output section should look like this instead and you should be good to go:

  elasticsearch {    hosts => ["localhost:9200"]    index => "logstash-apache"    document_id => "%{[@metadata][fingerprint]}"    manage_template => true                              <-- change this line    template => "/path/to/logstash/logstash-apache.json"    template_name => "logstash-apache"    template_overwrite => true  }