Create or update an index template
- POST also PUT /_index_template/{name}
Index templates define settings, mappings, and aliases that can be applied automatically to new indices.
Elasticsearch applies templates to new indices based on an wildcard pattern that matches the index name. Index templates are applied during data stream or index creation. For data streams, these settings and mappings are applied when the stream's backing indices are created. Settings and mappings specified in a create index API request override any settings or mappings specified in an index template. Changes to index templates do not affect existing indices, including the existing backing indices of a data stream.
You can use C-style /* *\/ block comments in index templates.
You can include comments anywhere in the request body, except before the opening curly bracket.
Multiple matching templates
If multiple index templates match the name of a new index or data stream, the template with the highest priority is used.
Multiple templates with overlapping index patterns at the same priority are not allowed and an error will be thrown when attempting to create a template matching an existing index template at identical priorities.
Composing aliases, mappings, and settings
When multiple component templates are specified in the composed_of field for an index template, they are merged in the order specified, meaning that later component templates override earlier component templates.
Any mappings, settings, or aliases from the parent index template are merged in next.
Finally, any configuration on the index request itself is merged.
Mapping definitions are merged recursively, which means that later mapping components can introduce new field mappings and update the mapping configuration.
If a field mapping is already contained in an earlier component, its definition will be completely overwritten by the later one.
This recursive merging strategy applies not only to field mappings, but also root options like dynamic_templates and meta.
If an earlier component contains a dynamic_templates block, then by default new dynamic_templates entries are appended onto the end.
If an entry already exists with the same key, then it is overwritten by the new definition.
- Cluster privileges:
manage_index_templates
Path Parameters
-
namestring Namerequired -
Index or template name
Query Parameters
-
createboolean · default: false If
true, this request cannot replace or update existing index templates.-
master_timeoutstring Duration · default: 30s Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.
-
causestring · default: api User defined reason for creating or updating the index template
Request
-
index_patternsstring Indices -
Array of wildcard (
*) expressions used to match the names of data streams and indices during creation. -
composed_ofstring Name -
An ordered list of component template names. Component templates are merged in the order specified, meaning that the last component template specified has the highest precedence.
-
templateIndexTemplateMapping -
Template to be applied. It may optionally include an
aliases,mappings, orsettingsconfiguration. -
aliasesmap string to Alias -
Aliases to add. If the index template includes a
data_streamobject, these are data stream aliases. Otherwise, these are index aliases. Data stream aliases ignore theindex_routing,routing, andsearch_routingoptions. -
<string>Alias -
filterQueryContainer -
Query used to limit documents the alias can access.
-
index_routingstring -
Value used to route indexing operations to a specific shard. If specified, this overwrites the
routingvalue for indexing operations. -
If
true, the alias is hidden. All indices for the alias must have the sameis_hiddenvalue. -
is_write_indexboolean · default: false -
If
true, the index is the write index for the alias. -
routingstring -
Value used to route indexing and search operations to a specific shard.
-
search_routingstring -
Value used to route search operations to a specific shard. If specified, this overwrites the
routingvalue for search operations. -
mappingsTypeMapping -
Mapping for fields in the index. If specified, this mapping can include field names, field data types, and mapping parameters.
-
all_fieldAllField -
analyzerstringrequired -
enabledbooleanrequired -
omit_normsbooleanrequired -
search_analyzerstringrequired -
similaritystringrequired -
storebooleanrequired -
store_term_vector_offsetsbooleanrequired -
store_term_vector_payloadsbooleanrequired -
store_term_vector_positionsbooleanrequired -
store_term_vectorsbooleanrequired -
date_detectionboolean -
dynamicDynamicMapping -
Values:
strictruntimetruefalse -
dynamic_date_formatsstring -
dynamic_templatesstring to DynamicTemplate -
_field_namesFieldNamesField -
enabledbooleanrequired -
index_fieldIndexField -
enabledbooleanrequired -
_metaMetadata -
numeric_detectionboolean -
propertiesmap string to Property -
_sourceSourceField -
enabledboolean -
excludesstring -
includesstring -
modeSourceFieldMode -
Supported values include:
disabledstoredcolumnar_storedsynthetic: Instead of storing source documents on disk exactly as you send them, Elasticsearch can reconstruct source content on the fly upon retrieval.
-
Values:
disabledstoredcolumnar_storedsynthetic -
runtimemap string to RuntimeField -
<string>RuntimeField -
fieldsmap string to CompositeSubField -
For type
composite -
<string>CompositeSubField -
typeRuntimeFieldTyperequired -
Values:
booleancompositedatedoublegeo_pointgeo_shapeipkeywordlonglookup -
formatstring -
A custom format for
datetype runtime fields. -
input_fieldstring Field -
For type
lookup -
target_fieldstring Field -
For type
lookup -
target_indexstring IndexName -
For type
lookup -
scriptstring Script -
Painless script executed at query time.
-
on_script_errorOnScriptError -
Values:
failcontinue -
typeRuntimeFieldTyperequired -
Field type, which can be:
boolean,composite,date,double,geo_point,ip,keyword,long, orlookup. -
Values:
booleancompositedatedoublegeo_pointgeo_shapeipkeywordlonglookup -
enabledboolean -
subobjectsSubobjects -
Values:
truefalse -
_data_stream_timestampDataStreamTimestamp -
enabledbooleanrequired -
settingsIndexSettings -
Configuration options for the index.
-
lifecycleDataStreamLifecycle -
data_retentionstring Duration -
If defined, every document added to this data stream will be stored at least for this time frame. Any time after this duration the document could be deleted. When empty, every document in this data stream will be stored indefinitely.
-
effective_retentionstring Duration -
The least amount of time data should be kept by elasticsearch.
-
retention_determined_byRetentionSource -
Configuration source that can influence the retention of a data stream.
-
Values:
data_stream_configurationdefault_global_retentionmax_global_retentiondefault_failures_retention -
downsamplingDownsamplingRound -
The list of downsampling rounds to execute as part of this downsampling configuration
-
afterstring Durationrequired -
The duration since rollover when this downsampling round should execute
-
fixed_intervalstringrequired -
The downsample interval.
-
downsampling_methodSamplingMethod -
The method used to downsample the data. There are two options
aggregateandlast_value. It requiresdownsamplingto be defined. Defaults toaggregate. -
Values:
aggregatelast_value -
enabledboolean · default: true -
If defined, it turns data stream lifecycle on/off (
true/false) for this data stream. A data stream lifecycle that's disabled (enabled:false) will have no effect on the data stream. -
frozen_afterstring Duration -
The period after which data stream backing indices are automatically converted to partially mounted searchable snapshots. This field is valid only on main data stream lifecycles and cannot be set on failure-store lifecycles.
-
data_stream_optionsoneOfnullable -
failure_storeoneOfnullable -
enabledboolean | string · default: truenullable -
If defined, it turns the failure store on/off (
true/false) for this data stream. A data stream failure store that's disabled (enabled:false) will redirect no new failed indices to the failure store; however, it will not remove any existing data from the failure store. -
lifecycleoneOfnullable -
If defined, it specifies the lifecycle configuration for the failure store of this data stream.
-
data_retentionDuration | stringnullable -
If defined, every document added to this data stream will be stored at least for this time frame. Any time after this duration the document could be deleted. When empty, every document in this data stream will be stored indefinitely.
-
enabledboolean · default: true -
If defined, it turns data stream lifecycle on/off (
true/false) for this data stream. A data stream lifecycle that's disabled (enabled:false) will have no effect on the data stream. -
data_streamDataStreamVisibility -
If this object is included, the template is used to create data streams and their backing indices. Supports an empty object. Data streams require a matching index template with a
data_streamobject. -
allow_custom_routingboolean -
failure_storeboolean -
prioritynumber -
Priority to determine index template precedence when a new data stream or index is created. The index template with the highest priority is chosen. If no priority is specified the template is treated as though it is of priority 0 (lowest priority). This number is not automatically generated by Elasticsearch.
-
versionnumber VersionNumber -
Version number used to manage index templates externally. This number is not automatically generated by Elasticsearch. External systems can use these version numbers to simplify template management. To unset a version, replace the template without specifying one.
-
_metaMetadata -
Optional user metadata about the index template. It may have any contents. It is not automatically generated or used by Elasticsearch. This user-defined object is stored in the cluster state, so keeping it short is preferable To unset the metadata, replace the template without specifying it.
-
allow_auto_createboolean -
This setting overrides the value of the
action.auto_create_indexcluster setting. If set totruein a template, then indices can be automatically created using that template even if auto-creation of indices is disabled viaactions.auto_create_index. If set tofalse, then indices or data streams matching the template must always be explicitly created, and may never be automatically created. -
ignore_missing_component_templatesstring -
The configuration option ignore_missing_component_templates can be used when an index template references a component template that might not exist
-
deprecatedboolean -
Marks this index template as deprecated. When creating or updating a non-deprecated index template that uses deprecated components, Elasticsearch will emit a deprecation warning.
Data stream options template contains the same information as DataStreamOptions but allows them to be set explicitly to null.
Template equivalent of DataStreamFailureStore that allows nullable values.
Template equivalent of FailureStoreLifecycle that allows nullable values.
string
string
string
Response
-
acknowledgedbooleanrequired -
For a successful response, this value is always true. On failure, an exception is returned instead.