IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Add a service name to logs Troubleshoot logs »
Elastic Docs ›Elastic Observability [8.16] ›Log monitoring

Logs index template reference

edit

Logs index template reference

edit

Index templates are used to configure the backing indices of data streams as they’re created. These index templates are composed of multiple component templates—reusable building blocks that configure index mappings, settings, and aliases.

You can view the default logs index template in Kibana. To open Index Management, find Stack Management in the main menu or use the global search field. Select Index Templates and search for logs. Select the logs index templates to view relevant component templates.

Edit the logs index template

edit

The default logs index template for the logs-*-* index pattern is composed of the following component templates:

  • logs@mappings
  • logs@settings
  • logs@custom
  • ecs@mappings

You can use the logs@custom component template to customize your Elasticsearch indices. The logs@custom component template is not installed by default, but you can create a component template named logs@custom to override and extend default mappings or settings. To do this:

  1. To open Index Management, find Stack Management in the main menu or use the global search field.
  2. Select Component Templates.
  3. Click Create component template.
  4. Name the component template logs@custom.
  5. Add any custom metadata, index settings, or mappings.

Changes to component templates are not applied retroactively to existing indices. For changes to take effect, create a new write index for impacted data streams by triggering a rollover. Do this using the Elasticsearch Rollover API. For example, to roll over the logs-generic-default data stream, run:

POST /logs-generic-default/_rollover/
Set the default_field using the custom template
edit

The logs index template uses default_field: [*] meaning queries without specified fields will search across all fields. You can update the default_field to search in the message field instead of all fields using the logs@custom component template.

If you haven’t already created the `logs@custom`component template, create it as outlined in the previous section. Then, follow these steps to update the Index settings of the component template:

  1. To open Index Management, find Stack Management in the main menu or use the global search field.
  2. Select Component Templates.
  3. Search for logs and find the logs@custom component template.
  4. Open the Actions menu and select Edit.

  5. Select Index settings and add the following code:

    {
  "index": {
    "query": {
      "default_field": [
        "message"
      ]
    }
  }
}
  6. Click Next through to the Review page and save the component template.
« Add a service name to logs Troubleshoot logs »