Graylog custom mapping for several templates

[ionzion (Ion)]

Hi @tmacgbay, thank you for reply and your advice. Yes you’ve understood right, I want to create custom template for two indexes gc-prod-* and dfa_*. I’ve tried the method you advised earlier and it didn’t work.
If I check what I’ve applied it shows:
curl -X GET ‘http://localhost:9200/_template/graylog-custom-mapping?pretty’

{
  "graylog-custom-mapping" : {
    "order" : 0,
    "index_patterns" : [
      "gc-prod-*"
    ],
    "settings" : {
      "index" : {
        "mapping" : {
          "total_fields" : {
            "limit" : "2000"
          }
        }
      }
    },
    "mappings" : { },
     "aliases" : { }
  }
}

So it applies only the first template the second template with:

{
"template": "dfa_*",
  "mappings": {
    "properties": {
      "app_time": {
        "type": "date",
        "format": "yyyy-MM-dd'T'HH:mm:ssZZZZZ"
      }
    }
  }
}

is missing. The only way I’ve found to apply this is to put all the mappings and settings in one template for all indexes with index pattern “*”. But this way I think is to dirty, so that is why I ask if there is one other way to do that.