Index templates in Elasticsearch - Step-by-Step Execution

Concept Flow - Index templates

Create or Update Template

↓

Define Index Patterns

↓

Set Settings, Mappings, Aliases

↓

Save Template

↓

New Index Created

↓

Template Matches Index Name?

No→Use Default Settings

Yes↓

Apply Template Settings, Mappings, Aliases

↓

Index Ready for Use

The flow shows how an index template is created and applied automatically to new indices matching its pattern.

Execution Sample

Elasticsearch

PUT _index_template/my_template
{
  "index_patterns": ["logs-*"] ,
  "template": {
    "settings": {"number_of_shards": 1}
  }
}

This creates an index template named 'my_template' that applies to indices starting with 'logs-' and sets shards to 1.

Execution Table

Step	Action	Input/Condition	Result/Output
1	Create template	Name: my_template, Pattern: logs-*	Template stored with pattern logs-*
2	New index creation	Index name: logs-2024-06-01	Check templates matching 'logs-2024-06-01'
3	Match template?	Does 'logs-2024-06-01' match 'logs-*'?	Yes, matches pattern
4	Apply template	Apply settings from 'my_template'	Index created with 1 shard
5	New index creation	Index name: data-2024-06-01	Check templates matching 'data-2024-06-01'
6	Match template?	Does 'data-2024-06-01' match 'logs-*'?	No match
7	Apply default	No matching template	Index created with default settings

💡 Execution stops after index creation with applied template or default settings.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	After Step 6	Final
Template Store	empty	my_template with pattern logs-*	my_template with pattern logs-*	my_template with pattern logs-*	my_template with pattern logs-*	my_template with pattern logs-*
Index Name	none	none	logs-2024-06-01	logs-2024-06-01	data-2024-06-01	data-2024-06-01
Template Match	none	none	true	true	false	false
Index Settings	default	default	applied shards=1	applied shards=1	default	default

Key Moments - 3 Insights

Why does the index 'data-2024-06-01' not get the template settings?

Because its name does not match the template pattern 'logs-*' as shown in execution_table step 6 where the match is false.

Can multiple templates apply to one index?

Yes, but in this example only one template matches. The system applies the best matching template or merges settings if multiple match.

What happens if no template matches an index?

The index is created with default settings, as shown in execution_table step 7 for 'data-2024-06-01'.

Visual Quiz - 3 Questions

Look at the execution_table, what is the shard count for the index 'logs-2024-06-01' after step 4?

A Default shard count

B 1 shard

C 5 shards

D 0 shards

💡 Hint

Check the 'Index Settings' variable in variable_tracker after step 4.

At which step does the index 'data-2024-06-01' fail to match the template pattern?

A Step 3

B Step 5

C Step 6

D Step 7

💡 Hint

Look at the 'Match template?' action and result in execution_table.

If the template pattern was changed to '*-2024-*', which index would match the template?

A Both 'logs-2024-06-01' and 'data-2024-06-01'

B Only 'logs-2024-06-01'

C Only 'data-2024-06-01'

D Neither index

💡 Hint

Consider how the pattern '*-2024-*' matches index names in execution_table steps 2 and 5.

Concept Snapshot

Index templates in Elasticsearch:
- Define patterns to match index names
- Set default settings, mappings, aliases
- Automatically apply when new index matches
- Helps keep index configurations consistent
- No effect on existing indices

Full Transcript

Index templates in Elasticsearch let you define settings and mappings that automatically apply to new indices matching a name pattern. First, you create or update a template with a pattern like 'logs-*'. When a new index is created, Elasticsearch checks if its name matches any template pattern. If yes, it applies the template's settings and mappings to the index. If no template matches, default settings are used. This process ensures new indices have consistent configurations without manual setup each time.

Practice

1.

What is the main purpose of an index template in Elasticsearch?

easy

A. To delete old indexes automatically

B. To run queries faster on existing indexes

C. To backup data from indexes

D. To automatically apply settings and mappings to new indexes matching a pattern

Solution

1. Step 1: Understand what index templates do

   Index templates define settings and mappings that apply automatically to new indexes matching a pattern.

2. Step 2: Compare options with this purpose

   Only To automatically apply settings and mappings to new indexes matching a pattern describes this automatic application of settings and mappings.

3. Final Answer:

   To automatically apply settings and mappings to new indexes matching a pattern -> Option D

4. Quick Check:

   Index templates = auto apply settings [OK]

Hint: Index templates set rules for new indexes automatically [OK]

Common Mistakes:

• Thinking templates delete or backup data
• Confusing templates with query optimization
• Believing templates apply to existing indexes only

2.

Which of the following is the correct way to specify an index pattern in an Elasticsearch index template?

{
  "index_patterns": ["logs-*"]
}

easy

A. "index_patterns": "logs-*"

B. "index_patterns": ["logs-*"]

C. "index_patterns": {"logs-*"}

D. "index_patterns": logs-*

Solution

1. Step 1: Recall correct JSON syntax for index_patterns

   The index_patterns field expects an array of strings, so it must be inside square brackets.

2. Step 2: Check each option's syntax

   Only "index_patterns": ["logs-*"] uses an array with a string inside: ["logs-*"] which is correct JSON syntax.

3. Final Answer:

   "index_patterns": ["logs-*"] -> Option B

4. Quick Check:

   Patterns must be in array format [OK]

Hint: Patterns always go inside square brackets as a list [OK]

Common Mistakes:

• Using a string instead of an array
• Using curly braces instead of square brackets
• Omitting quotes around the pattern

3.

Given this index template:

{
  "index_patterns": ["app-logs-*"],
  "template": {
    "settings": {"number_of_shards": 2},
    "mappings": {"properties": {"user": {"type": "keyword"}}}
  }
}

What will be the number of shards and mapping type for the index app-logs-2024?

medium

A. 2 shards, user field as text

B. 1 shard, user field as text

C. 2 shards, user field as keyword

D. 1 shard, user field as keyword

Solution

1. Step 1: Match index name with pattern

   The index name app-logs-2024 matches the pattern app-logs-* in the template.

2. Step 2: Apply template settings and mappings

   The template sets number_of_shards to 2 and maps the user field as keyword type.

3. Final Answer:

   2 shards, user field as keyword -> Option C

4. Quick Check:

   Matching pattern applies template settings [OK]

Hint: Check if index name fits pattern, then apply template settings [OK]

Common Mistakes:

• Assuming default shard count instead of template value
• Confusing keyword with text mapping type
• Ignoring pattern matching rules

4.

Identify the error in this index template snippet:

{
  "index_patterns": "logs-*",
  "template": {
    "settings": {"number_of_replicas": 1}
  }
}

medium

A. "index_patterns" should be an array, not a string

B. "number_of_replicas" is not a valid setting

C. "template" key is missing required "mappings"

D. The pattern "logs-*" is invalid

Solution

1. Step 1: Check the type of index_patterns

   The index_patterns field must be an array of strings, but here it is a single string.

2. Step 2: Validate other fields

   number_of_replicas is a valid setting, mappings is optional, and the pattern syntax is correct.

3. Final Answer:

   "index_patterns" should be an array, not a string -> Option A

4. Quick Check:

   index_patterns must be an array [OK]

Hint: index_patterns always needs square brackets [OK]

Common Mistakes:

• Using string instead of array for index_patterns
• Thinking mappings are always required
• Assuming pattern syntax is wrong when it's correct

5.

You want to create an index template that applies to all indexes starting with sales- but excludes those ending with -archive. Which approach correctly achieves this?

hard

A. Use index_patterns": ["sales-*"] and create a separate template with higher priority for sales-*-archive that overrides settings

B. Use index_patterns": ["sales-*"] and rely on manual exclusion when creating indexes

C. Use index_patterns": ["sales-*"] and add a composed_of template excluding sales-*-archive

D. Use index_patterns": ["sales-*"] and add a priority template for sales-*-archive with no settings

Solution

1. Step 1: Understand template priority and pattern matching

   Elasticsearch applies templates by priority; higher priority templates override lower ones.

2. Step 2: Exclude indexes by overriding with higher priority template

   To exclude sales-*-archive, create a separate template with higher priority that overrides or clears settings for those indexes.

3. Final Answer:

   Create a higher priority template for sales-*-archive to override settings -> Option A

4. Quick Check:

   Use priority to override unwanted index templates [OK]

Hint: Use higher priority template to override exclusions [OK]

Common Mistakes:

• Assuming manual exclusion works automatically
• Using composed_of incorrectly for exclusion
• Not setting template priority to control overrides