Add a custom mapping field in Logstash config file for Elastic Search Index


I love the feature where Logstash automatically creates an index as per day by default, but is it possible to allow the users to add their own mappings so that it doesn't cause problems during indexing?

This will help users who want mappings in Elastic Search to be consistent.


Jordan Sissel
February 22, 2012, 3:48 AM

Your best bet here is to use elasticsearch's 'index template' feature. You can define index templates based on the index name (with wildcard support) to automatically configure new indexes.

Logstash's default index name is "" for example (where the YYYY, etc are replaced with the current day), so you can create an index template matching "logstash-*"

See here:

Let me know if this helps you or not

Jonathan Moo
February 22, 2012, 5:39 AM

Hey thanks! That works wonders!

You have been a great help, how can I be a support to this Logstash project?

Jordan Sissel
August 21, 2012, 7:29 AM

Index templates! WOO


Jordan Sissel


Jonathan Moo