Control Elasticsearch mappings before Logstash writes data

Define the mapping before Logstash writes the first document. However, mapping known fields does not stop Elasticsearch from dynamically adding unknown ones. Template installation and dynamic field mapping are separate mechanisms.

The following examples use Kibana Dev Tools syntax and ordinary indices.

Pre-create a fixed index

PUT my-logs
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": { "type": "date" },
      "@version": { "type": "keyword" },
      "level": { "type": "keyword" },
      "message": { "type": "text" },
      "response_time": { "type": "float" }
    }
  }
}

dynamic: "strict" rejects documents containing undeclared fields. The schema must therefore include everything your actual pipeline sends, including collector metadata, or the pipeline must remove unwanted fields first. Route mapping failures to a monitored recovery path rather than discarding them.

Use dynamic: false if you want unknown values retained in _source without dynamically indexing them. Leaving dynamic mapping enabled allows new fields to be added even though the listed fields already have explicit mappings.

Apply a template to future indices

PUT _index_template/app-logs-template
{
  "index_patterns": ["app-logs-*"],
  "priority": 200,
  "template": {
    "mappings": {
      "dynamic": false,
      "properties": {
        "@timestamp": { "type": "date" },
        "message": { "type": "text" },
        "level": { "type": "keyword" }
      }
    }
  }
}

Choose a nonconflicting pattern and priority for your cluster. Templates apply when an index is created; editing a template does not repair an existing index's field types.

Decide who installs the template

If you manage templates through Elasticsearch APIs, disable Logstash template management:

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "app-logs-%{+yyyy.MM.dd}"
    ilm_enabled => false
    data_stream => false
    manage_template => false
  }
}

Alternatively, let the output plugin install a custom template with template, template_name, and the appropriate template_api. For a composable template, the JSON must use composable-template structure. template_overwrite => true replaces the named template; it does not rewrite existing mappings. Do not mix this ordinary-index example with an ILM rollover alias or data stream configuration. Add TLS and credentials outside a local test.

Repair an existing mapping

Inspect it with GET my-index/_mapping. Most field type changes require a new index, reindexing into the corrected schema, and a controlled alias switch. Adding a multi-field does not populate it for documents already indexed; those need reprocessing too.

Dynamic mapping can create text plus keyword fields or infer dates. Numeric detection for numeric-looking strings is disabled by default; do not assume every number-shaped string becomes a numeric field.

References: dynamic mapping and Logstash template settings.