Create or update a component template

  • POST also PUT /_component_template/{name}
Auth

Component templates are building blocks for constructing index templates that specify index mappings, settings, and aliases.

An index template can be composed of multiple component templates. To use a component template, specify it in an index template’s composed_of list. Component templates are only applied to new data streams and indices as part of a matching index template.

Settings and mappings specified directly in the index template or the create index request override any settings or mappings specified in a component template.

Component templates are only used during index creation. For data streams, this includes data stream creation and the creation of a stream’s backing indices. Changes to component templates do not affect existing indices, including a stream’s backing indices.

You can use C-style /* *\/ block comments in component templates. You can include comments anywhere in the request body except before the opening curly bracket.

Applying component templates

You cannot directly apply a component template to a data stream or index. To be applied, a component template must be included in an index template's composed_of list.

Required privileges

Cluster privileges manage_index_templates

Path parameters

name string required

Name of the component template to create. Elasticsearch includes the following built-in component templates: logs-mappings; logs-settings; metrics-mappings; metrics-settings;synthetics-mapping; synthetics-settings. Elastic Agent uses these templates to configure backing indices for its data streams. If you use Elastic Agent and want to overwrite one of these templates, set the version for your replacement template higher than the current version. If you don’t use Elastic Agent and want to disable all built-in component and index templates, set stack.templates.enabled to false using the cluster update settings API.

Query parameters

create boolean · default: false

If true, this request cannot replace or update existing component templates.

cause string · default: api

User defined reason for create the component template.

master_timeout string · default: 30s

Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

Request body

template object required

The template to be applied which includes mappings, settings, or aliases configuration.

aliases map string to object

Aliases to add. If the index template includes a data_stream object, these are data stream aliases. Otherwise, these are index aliases. Data stream aliases ignore the index_routing, routing, and search_routing options.

<string> object
filter {} Query

Query used to limit documents the alias can access.

index_routing string

Value used to route indexing operations to a specific shard. If specified, this overwrites the routing value for indexing operations.

is_hidden boolean · default: false

If true, the alias is hidden. All indices for the alias must have the same is_hidden value.

is_write_index boolean · default: false

If true, the index is the write index for the alias.

routing string

Value used to route indexing and search operations to a specific shard.

search_routing string

Value used to route search operations to a specific shard. If specified, this overwrites the routing value for search operations.

mappings object

Mapping for fields in the index. If specified, this mapping can include field names, field data types, and mapping parameters.

all_field object
analyzer string required
enabled boolean required
omit_norms boolean required
search_analyzer string required
similarity string required
store boolean required
store_term_vector_offsets boolean required
store_term_vector_payloads boolean required
store_term_vector_positions boolean required
store_term_vectors boolean required
date_detection boolean
dynamic enum
Values: strict runtime true false
dynamic_date_formats string[]
dynamic_templates string to object[]
_field_names object
enabled boolean required
index_field object
enabled boolean required
_meta object
numeric_detection boolean
properties map string to oneOf
_routing object
required boolean required
_size object
enabled boolean required
_source object
enabled boolean
excludes string[]
includes string[]
mode enum

Supported values include:

  • disabled
  • stored
  • synthetic: Instead of storing source documents on disk exactly as you send them, Elasticsearch can reconstruct source content on the fly upon retrieval.
Values: disabled stored synthetic
runtime map string to object
<string> object
fields map string to object

For type composite

<string> object
type enum required
Values: boolean composite date double geo_point geo_shape ip keyword long lookup
fetch_fields object[]

For type lookup

field string required
format string
format string

A custom format for date type runtime fields.

input_field string

For type lookup

target_field string

For type lookup

target_index string

For type lookup

script string

Painless script executed at query time.

on_script_error enum
Values: fail continue
type enum required

Field type, which can be: boolean, composite, date, double, geo_point, ip,keyword, long, or lookup.

Values: boolean composite date double geo_point geo_shape ip keyword long lookup
enabled boolean
subobjects enum
Values: true false
_data_stream_timestamp object
enabled boolean required
settings object

Configuration options for the index.

lifecycle object
data_retention string

If defined, every document added to this data stream will be stored at least for this time frame. Any time after this duration the document could be deleted. When empty, every document in this data stream will be stored indefinitely.

effective_retention string

The least amount of time data should be kept by elasticsearch.

retention_determined_by enum

Configuration source that can influence the retention of a data stream.

Values: data_stream_configuration default_global_retention max_global_retention default_failures_retention
downsampling object[]

The list of downsampling rounds to execute as part of this downsampling configuration

after string required

The duration since rollover when this downsampling round should execute

fixed_interval string required

The downsample interval.

downsampling_method enum

The method used to downsample the data. There are two options aggregate and last_value. It requires downsampling to be defined. Defaults to aggregate.

Values: aggregate last_value
enabled boolean · default: true

If defined, it turns data stream lifecycle on/off (true/false) for this data stream. A data stream lifecycle that's disabled (enabled: false) will have no effect on the data stream.

data_stream_options union oneOf nullable
One of:

Data stream options template contains the same information as DataStreamOptions but allows them to be set explicitly to null.

failure_store union oneOf nullable
One of:

Template equivalent of DataStreamFailureStore that allows nullable values.

enabled union boolean | string · default: true nullable

If defined, it turns the failure store on/off (true/false) for this data stream. A data stream failure store that's disabled (enabled: false) will redirect no new failed indices to the failure store; however, it will not remove any existing data from the failure store.

lifecycle union oneOf nullable

If defined, it specifies the lifecycle configuration for the failure store of this data stream.

One of:

Template equivalent of FailureStoreLifecycle that allows nullable values.

data_retention union string nullable

If defined, every document added to this data stream will be stored at least for this time frame. Any time after this duration the document could be deleted. When empty, every document in this data stream will be stored indefinitely.

enabled boolean · default: true

If defined, it turns data stream lifecycle on/off (true/false) for this data stream. A data stream lifecycle that's disabled (enabled: false) will have no effect on the data stream.

version number

Version number used to manage component templates externally. This number isn't automatically generated or incremented by Elasticsearch. To unset a version, replace the template without specifying a version.

_meta object

Optional user metadata about the component template. It may have any contents. This map is not automatically generated by Elasticsearch. This information is stored in the cluster state, so keeping it short is preferable. To unset _meta, replace the template without specifying this information.

deprecated boolean

Marks this index template as deprecated. When creating or updating a non-deprecated index template that uses deprecated components, Elasticsearch will emit a deprecation warning.

Response

application/json
acknowledged boolean required

For a successful response, this value is always true. On failure, an exception is returned instead.