# Elasticsearch index template overwritten on rotation

**URL:** <https://community.graylog.org/t/elasticsearch-index-template-overwritten-on-rotation/29134>\
**Category:** Graylog Central (peer support)\
**Created:** [June 13, 2023, 7:02am UTC](https://community.graylog.org/t/elasticsearch-index-template-overwritten-on-rotation/29134 "2023-06-13T07:02:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ulischell](https://avatars.discourse-cdn.com/v4/letter/u/e95f7d/32.png) [@ulischell](https://community.graylog.org/u/ulischell)\
**Post date:** [June 13, 2023, 7:02am UTC](https://community.graylog.org/t/elasticsearch-index-template-overwritten-on-rotation/29134/1 "2023-06-13T07:02:50Z")

</div>

Hello,  
this question has the same root cause as: [Graylog rewriting "index template" in Elasticsearch](https://community.graylog.org/t/graylog-rewriting-index-template-in-elasticsearch/18901)

i put in a template for an index set, and once it rotates to the new index set, having the new values i put in the template, the template gets overwritten.

sure i can do a daily cronjob to put in templates, but there has to be a nicer place to fix that ?

thanks !

---

<div class="post-metadata">

**Author:** ![frantz](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@frantz](https://community.graylog.org/u/frantz)\
**Post date:** [June 14, 2023, 3:54pm UTC](https://community.graylog.org/t/elasticsearch-index-template-overwritten-on-rotation/29134/2 "2023-06-14T15:54:01Z")

</div>

Hello,  
I think it’s because you are using the default graylog-internal template.  
Create another new template with another name and it won’t be overwritten.

---

<div class="post-metadata">

**Author:** ![ulischell](https://avatars.discourse-cdn.com/v4/letter/u/e95f7d/32.png) [@ulischell](https://community.graylog.org/u/ulischell)\
**Post date:** [June 14, 2023, 4:40pm UTC](https://community.graylog.org/t/elasticsearch-index-template-overwritten-on-rotation/29134/3 "2023-06-14T16:40:44Z")

</div>

Hello, thanks for the reply, no its not the default, i put in index fields 2500:  
root@graylog1:~# curl -X PUT -d @‘graysit\_custom\_template.json’ -H ‘Content-Type: application/json’ ‘[http://localhost:9200/\_template/win-template?pretty](http://localhost:9200/_template/win-template?pretty)’  
{  
“acknowledged” : true  
}  
root@graylog1:~# curl -XGET ‘[http://localhost:9200/\_template/win-template](http://localhost:9200/_template/win-template)’  
{“win-template”:{“order”:-1,“index\_patterns”:[“win\__"],“settings”:{“index”:{“analysis”:{“analyzer”:{“analyzer\_keyword”:{“filter”:“lowercase”,“tokenizer”:“keyword”}}},“mapping”:{“total\_fields”:{“limit”:“2500”}}}},“mappings”:{"source":{“enabled”:true},“dynamic\_templates”:[{“internal\_fields”:{“mapping”:{“type”:“keyword”},“match\_mapping\_type”:“string”,“match”:"gl2_”}},{“store\_generic”:{“mapping”:{“type”:“keyword”},“match\_mapping\_type”:“string”}}],“properties”:{“gl2\_processing\_timestamp”:{“format”:“uuuu-MM-dd HH:mm:ss.SSS”,“type”:“date”},“gl2\_accounted\_message\_size”:{“type”:“long”},“gl2\_receive\_timestamp”:{“format”:“uuuu-MM-dd HH:mm:ss.SSS”,“type”:“date”},“full\_message”:{“fielddata”:false,“analyzer”:“standard”,“type”:“text”},“streams”:{“type”:“keyword”},“source”:{“fielddata”:true,“analyzer”:“analyzer\_keyword”,“type”:“text”},“message”:{“fielddata”:false,“analyzer”:“standard”,“type”:“text”},“timestamp”:{“format”:“uuuu-MM-dd HH:mm:ss.SSS”,“type”:“date”}}},“aliases”:{}}}root@graylog1:~#

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 28, 2023, 4:41pm UTC](https://community.graylog.org/t/elasticsearch-index-template-overwritten-on-rotation/29134/4 "2023-06-28T16:41:11Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.