Create or update a component template
- POST also PUT /_component_template/{name}
Component templates are building blocks for constructing index templates that specify index mappings, settings, and aliases.
An index template can be composed of multiple component templates.
To use a component template, specify it in an index template’s composed_of list.
Component templates are only applied to new data streams and indices as part of a matching index template.
Settings and mappings specified directly in the index template or the create index request override any settings or mappings specified in a component template.
Component templates are only used during index creation. For data streams, this includes data stream creation and the creation of a stream’s backing indices. Changes to component templates do not affect existing indices, including a stream’s backing indices.
You can use C-style /* *\/ block comments in component templates.
You can include comments anywhere in the request body except before the opening curly bracket.
Applying component templates
You cannot directly apply a component template to a data stream or index.
To be applied, a component template must be included in an index template's composed_of list.
- Cluster privileges:
manage_index_templates
Path Parameters
-
namestring Namerequired -
Name of the component template to create. Elasticsearch includes the following built-in component templates:
logs-mappings;logs-settings;metrics-mappings;metrics-settings;synthetics-mapping;synthetics-settings. Elastic Agent uses these templates to configure backing indices for its data streams. If you use Elastic Agent and want to overwrite one of these templates, set theversionfor your replacement template higher than the current version. If you don’t use Elastic Agent and want to disable all built-in component and index templates, setstack.templates.enabledtofalseusing the cluster update settings API.
Query Parameters
-
createboolean · default: false If
true, this request cannot replace or update existing component templates.-
causestring · default: api User defined reason for create the component template.
-
master_timeoutstring Duration · default: 30s Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.
Request
-
templateIndexTemplateMappingrequired -
The template to be applied which includes mappings, settings, or aliases configuration.
-
aliasesmap string to Alias -
Aliases to add. If the index template includes a
data_streamobject, these are data stream aliases. Otherwise, these are index aliases. Data stream aliases ignore theindex_routing,routing, andsearch_routingoptions. -
<string>Alias -
filterQueryContainer -
Query used to limit documents the alias can access.
-
index_routingstring -
Value used to route indexing operations to a specific shard. If specified, this overwrites the
routingvalue for indexing operations. -
If
true, the alias is hidden. All indices for the alias must have the sameis_hiddenvalue. -
is_write_indexboolean · default: false -
If
true, the index is the write index for the alias. -
routingstring -
Value used to route indexing and search operations to a specific shard.
-
search_routingstring -
Value used to route search operations to a specific shard. If specified, this overwrites the
routingvalue for search operations. -
mappingsTypeMapping -
Mapping for fields in the index. If specified, this mapping can include field names, field data types, and mapping parameters.
-
all_fieldAllField -
analyzerstringrequired -
enabledbooleanrequired -
omit_normsbooleanrequired -
search_analyzerstringrequired -
similaritystringrequired -
storebooleanrequired -
store_term_vector_offsetsbooleanrequired -
store_term_vector_payloadsbooleanrequired -
store_term_vector_positionsbooleanrequired -
store_term_vectorsbooleanrequired -
date_detectionboolean -
dynamicDynamicMapping -
Values:
strictruntimetruefalse -
dynamic_date_formatsstring -
dynamic_templatesstring to DynamicTemplate -
_field_namesFieldNamesField -
enabledbooleanrequired -
index_fieldIndexField -
enabledbooleanrequired -
_metaMetadata -
numeric_detectionboolean -
propertiesmap string to Property -
_sourceSourceField -
runtimemap string to RuntimeField -
<string>RuntimeField -
fieldsmap string to CompositeSubField -
For type
composite -
<string>CompositeSubField -
typeRuntimeFieldTyperequired -
Values:
booleancompositedatedoublegeo_pointgeo_shapeipkeywordlonglookup -
formatstring -
A custom format for
datetype runtime fields. -
input_fieldstring Field -
For type
lookup -
target_fieldstring Field -
For type
lookup -
target_indexstring IndexName -
For type
lookup -
scriptstring Script -
Painless script executed at query time.
-
on_script_errorOnScriptError -
Values:
failcontinue -
typeRuntimeFieldTyperequired -
Field type, which can be:
boolean,composite,date,double,geo_point,ip,keyword,long, orlookup. -
Values:
booleancompositedatedoublegeo_pointgeo_shapeipkeywordlonglookup -
enabledboolean -
subobjectsSubobjects -
Values:
truefalse -
_data_stream_timestampDataStreamTimestamp -
enabledbooleanrequired -
settingsIndexSettings -
Configuration options for the index.
-
lifecycleDataStreamLifecycle -
data_retentionstring Duration -
If defined, every document added to this data stream will be stored at least for this time frame. Any time after this duration the document could be deleted. When empty, every document in this data stream will be stored indefinitely.
-
effective_retentionstring Duration -
The least amount of time data should be kept by elasticsearch.
-
retention_determined_byRetentionSource -
Configuration source that can influence the retention of a data stream.
-
Values:
data_stream_configurationdefault_global_retentionmax_global_retentiondefault_failures_retention -
downsamplingDownsamplingRound -
The list of downsampling rounds to execute as part of this downsampling configuration
-
afterstring Durationrequired -
The duration since rollover when this downsampling round should execute
-
fixed_intervalstringrequired -
The downsample interval.
-
downsampling_methodSamplingMethod -
The method used to downsample the data. There are two options
aggregateandlast_value. It requiresdownsamplingto be defined. Defaults toaggregate. -
Values:
aggregatelast_value -
enabledboolean · default: true -
If defined, it turns data stream lifecycle on/off (
true/false) for this data stream. A data stream lifecycle that's disabled (enabled:false) will have no effect on the data stream. -
data_stream_optionsoneOfnullable -
failure_storeoneOfnullable -
enabledboolean | string · default: truenullable -
If defined, it turns the failure store on/off (
true/false) for this data stream. A data stream failure store that's disabled (enabled:false) will redirect no new failed indices to the failure store; however, it will not remove any existing data from the failure store. -
lifecycleoneOfnullable -
If defined, it specifies the lifecycle configuration for the failure store of this data stream.
-
data_retentionDuration | stringnullable -
If defined, every document added to this data stream will be stored at least for this time frame. Any time after this duration the document could be deleted. When empty, every document in this data stream will be stored indefinitely.
-
enabledboolean · default: true -
If defined, it turns data stream lifecycle on/off (
true/false) for this data stream. A data stream lifecycle that's disabled (enabled:false) will have no effect on the data stream. -
versionnumber VersionNumber -
Version number used to manage component templates externally. This number isn't automatically generated or incremented by Elasticsearch. To unset a version, replace the template without specifying a version.
-
_metaMetadata -
Optional user metadata about the component template. It may have any contents. This map is not automatically generated by Elasticsearch. This information is stored in the cluster state, so keeping it short is preferable. To unset
_meta, replace the template without specifying this information. -
deprecatedboolean -
Marks this index template as deprecated. When creating or updating a non-deprecated index template that uses deprecated components, Elasticsearch will emit a deprecation warning.
Data stream options template contains the same information as DataStreamOptions but allows them to be set explicitly to null.
Template equivalent of DataStreamFailureStore that allows nullable values.
Template equivalent of FailureStoreLifecycle that allows nullable values.
string
string
string
Response
-
acknowledgedbooleanrequired -
For a successful response, this value is always true. On failure, an exception is returned instead.