ELK Stack — Index Templates

Index Templates

Index templates let you define settings, mappings, and aliases that are automatically applied whenever a new index is created that matches a given name pattern. Instead of manually configuring every index, you define the blueprint once and Elasticsearch handles the rest.

---

Why Index Templates Matter

In production, indices are created continuously — think daily log indices like logs-2026.04.01. Without templates you would have to set mappings and shard counts on every single index. Templates solve this by providing a “cookie cutter” that is applied automatically at index creation time.

---

Legacy vs Composable Index Templates

Elasticsearch supports two template systems:

Feature	Legacy Templates	Composable Templates
API	_template	_index_template
Reusable parts	No	Yes (component templates)
Priority resolution	order field	priority field
Recommended	No (deprecated in 7.8+)	Yes

Important: Always use composable index templates for new deployments. Legacy templates are deprecated and will be removed in a future major version.

---

Component Templates

Component templates are reusable building blocks. A composable index template can reference one or more component templates, combining their settings, mappings, and aliases.

Create a Component Template for Settings

curl -s -X PUT "localhost:9200/_component_template/shared-settings" \
  -H "Content-Type: application/json" \
  -d '{
  "template": {
    "settings": {
      "number_of_shards": 2,
      "number_of_replicas": 1,
      "refresh_interval": "5s"
    }
  },
  "_meta": {
    "description": "Shared shard and replica settings"
  }
}'

{
  "acknowledged": true
}

Create a Component Template for Mappings

curl -s -X PUT "localhost:9200/_component_template/log-mappings" \
  -H "Content-Type: application/json" \
  -d '{
  "template": {
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "message":    { "type": "text" },
        "log.level":  { "type": "keyword" },
        "host.name":  { "type": "keyword" }
      }
    }
  },
  "_meta": {
    "description": "Common log field mappings"
  }
}'

{
  "acknowledged": true
}

---

Composable Index Templates

A composable index template ties component templates together, specifies index patterns, and can add its own overrides.

Create a Composable Index Template

curl -s -X PUT "localhost:9200/_index_template/logs-template" \
  -H "Content-Type: application/json" \
  -d '{
  "index_patterns": ["logs-*"],
  "composed_of": ["shared-settings", "log-mappings"],
  "priority": 200,
  "template": {
    "aliases": {
      "logs-current": {}
    },
    "settings": {
      "index.lifecycle.name": "logs-policy"
    }
  },
  "_meta": {
    "description": "Template for all log indices"
  }
}'

{
  "acknowledged": true
}

Verify the Template

curl -s -X GET "localhost:9200/_index_template/logs-template?pretty"

{
  "index_templates": [
    {
      "name": "logs-template",
      "index_template": {
        "index_patterns": ["logs-*"],
        "composed_of": ["shared-settings", "log-mappings"],
        "priority": 200,
        "template": {
          "aliases": {
            "logs-current": {}
          },
          "settings": {
            "index": {
              "lifecycle": {
                "name": "logs-policy"
              }
            }
          }
        },
        "_meta": {
          "description": "Template for all log indices"
        }
      }
    }
  ]
}

---

Index Template Structure

A composable index template contains these key fields:

Field	Required	Description
index_patterns	Yes	Array of wildcard patterns that match index names
composed_of	No	Ordered list of component template names
priority	No	Numeric priority — higher wins when multiple templates match
template	No	Inline settings, mappings, and aliases (overrides components)
_meta	No	Arbitrary metadata for documentation
data_stream	No	Object that marks this template for data streams
version	No	Version number for external management tools

---

Template Matching and Priority

When you create an index named logs-2026.04.01, Elasticsearch finds every composable template whose index_patterns matches that name, then selects the one with the highest priority.

# Template A — priority 100, matches logs-*
# Template B — priority 200, matches logs-*
# Template C — priority 150, matches logs-2026*

# Creating index "logs-2026.04.01" → Template B wins (priority 200)

Tip: Use a clear priority scheme. For example, generic templates at 100, team-specific at 200, and override templates at 500.

---

Index Templates and Data Streams

Data streams require a matching index template with data_stream: {}. The template must include a @timestamp mapping of type date or date_nanos.

curl -s -X PUT "localhost:9200/_index_template/metrics-ds-template" \
  -H "Content-Type: application/json" \
  -d '{
  "index_patterns": ["metrics-*"],
  "data_stream": {},
  "composed_of": ["shared-settings"],
  "priority": 200,
  "template": {
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "metric.name": { "type": "keyword" },
        "metric.value": { "type": "double" }
      }
    }
  }
}'

{
  "acknowledged": true
}

Once the template exists, writing a document to metrics-app will automatically create a data stream:

curl -s -X POST "localhost:9200/metrics-app/_doc" \
  -H "Content-Type: application/json" \
  -d '{
  "@timestamp": "2026-04-01T09:00:00Z",
  "metric.name": "cpu_usage",
  "metric.value": 72.5
}'

{
  "_index": ".ds-metrics-app-2026.04.01-000001",
  "_id": "abc123",
  "_version": 1,
  "result": "created",
  "_shards": { "total": 2, "successful": 1, "failed": 0 },
  "_seq_no": 0,
  "_primary_term": 1
}

---

Managing Templates

List All Index Templates

curl -s -X GET "localhost:9200/_index_template?pretty"

Delete an Index Template

curl -s -X DELETE "localhost:9200/_index_template/logs-template"

{
  "acknowledged": true
}

List All Component Templates

curl -s -X GET "localhost:9200/_component_template?pretty"

Delete a Component Template

curl -s -X DELETE "localhost:9200/_component_template/shared-settings"

{
  "acknowledged": true
}

Note: You cannot delete a component template that is still referenced by an index template. Remove the reference first.

---

Simulate Template Resolution

Use the simulate API to see exactly what settings, mappings, and aliases would be applied to a new index:

curl -s -X POST "localhost:9200/_index_template/_simulate_index/logs-2026.04.01?pretty"

{
  "template": {
    "settings": {
      "index": {
        "number_of_shards": "2",
        "number_of_replicas": "1",
        "refresh_interval": "5s",
        "lifecycle": {
          "name": "logs-policy"
        }
      }
    },
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "message":    { "type": "text" },
        "log.level":  { "type": "keyword" },
        "host.name":  { "type": "keyword" }
      }
    },
    "aliases": {
      "logs-current": {}
    }
  },
  "overlapping": []
}

---

Quick Reference

Task	Command
Create component template	PUT _component_template/<name>
Create composable index template	PUT _index_template/<name>
Get index template	GET _index_template/<name>
Simulate template for index	POST _index_template/_simulate_index/<index-name>
Delete index template	DELETE _index_template/<name>
Delete component template	DELETE _component_template/<name>
List all index templates	GET _index_template
List all component templates	GET _component_template

---

Next → Index Lifecycle Management