Creating an index template

In this recipe, we will explore how to use index templates in Elasticsearch to define mappings, settings, and other configurations for new indices. Index templates automate the index creation process and ensure consistency across your Elasticsearch cluster.

Getting ready

Before we begin, familiarize yourself with creating component and index templates by using Kibana Dev Tools as explained in this documentation:

Make sure that you have completed the previous recipes:

• Using an analyzer
• Defining index mapping

All the commands for the Dev Tools in this recipe are available at this address: https://github.com/PacktPublishing/Elastic-Stack-8.x-Cookbook/blob/main/Chapter2/snippets.md#creating-an-index-template.

How to do it…

In this recipe, we will create two component templates – one for the genre field and another for *year fields with dynamic mapping – and then combine them in an index template:

1. Create the first component template for the genre field:

   PUT _component_template/movie-static-mapping
   {
     "template": {
       "mappings": {
         "properties": {
           "genre": {
             "type": "keyword"
           }
         }
       }
     }
   }

2. Create the second component template for the dynamic *year field:

   PUT _component_template/movie-dynamic-mapping
   {
     "template": {
       "mappings": {
         "dynamic_templates": [{
           "years_as_short": {
             "match_mapping_type": "long",
             "match": "*year",
             "mapping": {
               "type": "short"
             }
           }
         }]
       }
     }
   }

3. Create the index template, which consists of the component templates that we just created; additionally, we define an explicit mapping director field directly in the index template:

   PUT _index_template/movie-template
   {
     "index_patterns": ["movie*"],
     "template": {
       "settings": {
         "number_of_shards": 1
       },
       "mappings": {
         "_source": {
           "enabled": true
         },
         "properties": {
           "director": {
           "type": "keyword"
           }
         }
       },
       "aliases": {
         "mydata": { }
       }
     },
     "priority": 500,
     "composed_of": ["movie-static-mapping", "movie-dynamic-mapping"],
     "version": 1,
     "_meta": {
       "description": "movie template"
     }
   }

4. Now, we can index another new movie with a field called award_year, as follows:

   POST movies/_doc/
   {
     "award_year": 1998,
     "release_year": 1997,
     "title": "Titanic",
     "origin": "American",
     "director": "James Cameron",
     "cast": "Leonardo DiCaprio, Kate Winslet, Billy Zane, Frances Fisher, Victor Garber, Kathy Bates, Bill Paxton, Gloria Stuart, David Warner, Suzy Amis",
     "genre": "historical epic",
     "wiki_page": "https://en.wikipedia.org/wiki/Titanic_(1997_film)",
     "plot": "The ill-fated maiden voyage of the RMS Titanic, centering on a love story between a wealthy young woman and a poor artist aboard the luxurious, ill-fated R.M.S. Titanic"
   }

5. Let’s check the mapping after the document ingestion with the following command:

   GET /movies/_mapping

6. Note the updated mapping, as illustrated in Figure 2.17, with award_year dynamically mapped to short. Additionally, both the genre and director fields are mapped to keyword, thanks to our field definitions in the movie-static-mapping component template and the movie-template index template.

Figure 2.17 – The updated mapping for the movies index

How it works...

Index templates include various configuration settings, such as shard and replica initialization parameters, mapping configurations, and aliases. They also allow you to assign priorities to templates, with a default priority of 100.

Component templates act as building blocks for index templates, which can comprise settings, aliases, or mappings and can be combined in an index template, using the composed_of parameter.

Legacy index templates were deprecated upon the release of Elasticsearch 7.8.

Figure 2.18 gives you an overview of the relationship between index templates, component templates, and legacy templates:

Figure 2.18 – Index templates versus legacy index templates

There’s more…

Elasticsearch provides predefined index templates that are associated with index and data stream patterns (you can find more details in Chapter 4), such as logs-*-*, metrics-*-*, and synthetics-*-*, with a default priority of 100. If you wish to create custom index templates that override the predefined ones but still use the same patterns, you can assign a priority value higher than 100. If you want to disable the built-in index and component templates altogether, you can set the stack.templates.enabled configuration parameter to false; the detailed documentation can be found here: https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html.