Component templates are building blocks for constructing index templates that specify index mappings, settings, and aliases.
An index template can be composed of multiple component templates.
To use a component template, specify it in an index template’s composed_of list.
Component templates are only applied to new data streams and indices as part of a matching index template.
Settings and mappings specified directly in the index template or the create index request override any settings or mappings specified in a component template.
Component templates are only used during index creation. For data streams, this includes data stream creation and the creation of a stream’s backing indices. Changes to component templates do not affect existing indices, including a stream’s backing indices.
You can use C-style /* *\/ block comments in component templates.
You can include comments anywhere in the request body except before the opening curly bracket.
Applying component templates
You cannot directly apply a component template to a data stream or index.
To be applied, a component template must be included in an index template's composed_of list.
##Required authorization
- Cluster privileges:
manage_index_templates
Path parameters
-
Name of the component template to create. Elasticsearch includes the following built-in component templates:
logs-mappings;logs-settings;metrics-mappings;metrics-settings;synthetics-mapping;synthetics-settings. Elastic Agent uses these templates to configure backing indices for its data streams. If you use Elastic Agent and want to overwrite one of these templates, set theversionfor your replacement template higher than the current version. If you don’t use Elastic Agent and want to disable all built-in component and index templates, setstack.templates.enabledtofalseusing the cluster update settings API.
Query parameters
-
If
true, this request cannot replace or update existing component templates. -
Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.
Values are
-1or0.
Body
Required
-
Hide template attributes Show template attributes object
-
Hide aliases attribute Show aliases attribute object
-
Hide * attributes Show * attributes object
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation Hide filter attributes Show filter attributes object
-
Hide bool attributes Show bool attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
-
Hide boosting attributes Show boosting attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Floating point number between 0 and 1.0 used to decrease the relevance scores of documents matching the
negativequery. -
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide combined_fields attributes Show combined_fields attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
List of fields to search. Field wildcard patterns are allowed. Only
textfields are supported, and they must all have the same searchanalyzer. -
Text to search for in the provided
fields. Thecombined_fieldsquery analyzes the provided text before performing a search. -
If true, match phrase queries are automatically created for multi-term synonyms.
-
Values are
ororand. -
Values are
noneorall.
-
-
Hide constant_score attributes Show constant_score attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide dis_max attributes Show dis_max attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
One or more query clauses. Returned documents must match one or more of these queries. If a document matches multiple queries, Elasticsearch uses the highest relevance score.
-
Floating point number between 0 and 1.0 used to increase the relevance scores of documents matching multiple query clauses.
-
-
Hide exists attributes Show exists attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
Hide function_score attributes Show function_score attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Values are
multiply,replace,sum,avg,max, ormin. -
One or more functions that compute a new score for each document returned by the query.
-
Restricts the new score to not exceed the provided limit.
-
Excludes documents that do not meet the provided score threshold.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Values are
multiply,sum,avg,first,max, ormin.
-
-
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
External documentation -
Hide geo_bounding_box attributes Show geo_bounding_box attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Values are
memoryorindexed. -
Values are
coerce,ignore_malformed, orstrict. -
Set to
trueto ignore an unmapped field and not match any documents for this query. Set tofalseto throw an exception if the field is not mapped.
-
-
Hide geo_distance attributes Show geo_distance attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Values are
arcorplane. -
Values are
coerce,ignore_malformed, orstrict. -
Set to
trueto ignore an unmapped field and not match any documents for this query. Set tofalseto throw an exception if the field is not mapped.
-
-
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Hide geo_polygon attributes Show geo_polygon attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Values are
coerce,ignore_malformed, orstrict.
-
-
Hide geo_shape attributes Show geo_shape attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Set to
trueto ignore an unmapped field and not match any documents for this query. Set tofalseto throw an exception if the field is not mapped.
-
-
Hide has_child attributes Show has_child attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Indicates whether to ignore an unmapped
typeand not return any documents instead of an error. -
Maximum number of child documents that match the query allowed for a returned parent document. If the parent document exceeds this limit, it is excluded from the search results.
-
Minimum number of child documents that match the query required to match the query for a returned parent document. If the parent document does not meet this limit, it is excluded from the search results.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Values are
none,avg,sum,max, ormin.
-
-
Hide has_parent attributes Show has_parent attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Indicates whether to ignore an unmapped
parent_typeand not return any documents instead of an error. You can use this parameter to query multiple indices that may not contain theparent_type. -
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Indicates whether the relevance score of a matching parent document is aggregated into its child documents.
-
-
Hide ids attributes Show ids attributes object
-
Returns documents based on the order and proximity of matching terms.
External documentation -
Hide knn attributes Show knn attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The number of nearest neighbor candidates to consider per shard
-
The final number of nearest neighbors to return as top hits
-
The minimum similarity for a vector to be considered a match
-
-
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
External documentation -
Hide match_all attributes Show match_all attributes object
-
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query.External documentation -
Hide match_none attributes Show match_none attributes object
-
Analyzes the text and creates a phrase query out of the analyzed text.
External documentation -
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
External documentation -
Hide more_like_this attributes Show more_like_this attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
The analyzer that is used to analyze the free form text. Defaults to the analyzer associated with the first field in fields.
-
Each term in the formed query could be further boosted by their tf-idf score. This sets the boost factor to use when using this feature. Defaults to deactivated (0).
-
Controls whether the query should fail (throw an exception) if any of the specified fields are not of the supported types (
textorkeyword). -
A list of fields to fetch and analyze the text from. Defaults to the
index.query.default_fieldindex setting, which has a default value of*. -
Specifies whether the input documents should also be included in the search results returned.
-
The maximum document frequency above which the terms are ignored from the input document.
-
The maximum number of query terms that can be selected.
-
The maximum word length above which the terms are ignored. Defaults to unbounded (
0). -
The minimum document frequency below which the terms are ignored from the input document.
-
The minimum term frequency below which the terms are ignored from the input document.
-
The minimum word length below which the terms are ignored.
-
Values are
internal,external,external_gte, orforce.
-
-
Hide multi_match attributes Show multi_match attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Analyzer used to convert the text in the query value into tokens.
-
If
true, match phrase queries are automatically created for multi-term synonyms. -
If
true, edits for fuzzy matching include transpositions of two adjacent characters (for example,abtoba). Can be applied to the term subqueries constructed for all terms but the final term. -
If
true, format-based errors, such as providing a text query value for a numeric field, are ignored. -
Maximum number of terms to which the query will expand.
-
Values are
and,AND,or, orOR. -
Number of beginning characters left unchanged for fuzzy matching.
-
Text, number, boolean value or date you wish to find in the provided field.
-
Maximum number of positions allowed between matching tokens.
-
Determines how scores for each per-term blended query and scores across groups are combined.
-
Values are
best_fields,most_fields,cross_fields,phrase,phrase_prefix, orbool_prefix. -
Values are
allornone.
-
-
Hide nested attributes Show nested attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Indicates whether to ignore an unmapped path and not return any documents instead of an error.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Values are
none,avg,sum,max, ormin.
-
-
Hide parent_id attributes Show parent_id attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Indicates whether to ignore an unmapped
typeand not return any documents instead of an error.
-
-
Hide percolate attributes Show percolate attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
The source of the document being percolated.
-
An array of sources of the documents being percolated.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The suffix used for the
_percolator_document_slotfield when multiplepercolatequeries are specified. -
Preference used to fetch document to percolate.
-
-
Hide pinned attributes Show pinned attributes object
-
Returns documents that contain a specific prefix in a provided field.
External documentation -
Hide query_string attributes Show query_string attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
If
true, the wildcard characters*and?are allowed as the first character of the query string. -
Analyzer used to convert text in the query string into tokens.
-
If
true, the query attempts to analyze wildcard terms in the query string. -
If
true, match phrase queries are automatically created for multi-term synonyms. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Values are
and,AND,or, orOR. -
If
true, enable position increments in queries constructed from aquery_stringsearch. -
Array of fields to search. Supports wildcards (
*). -
Maximum number of terms to which the query expands for fuzzy matching.
-
Number of beginning characters left unchanged for fuzzy matching.
-
If
true, edits for fuzzy matching include transpositions of two adjacent characters (for example,abtoba). -
If
true, format-based errors, such as providing a text value for a numeric field, are ignored. -
Maximum number of automaton states required for the query.
-
Maximum number of positions allowed between matching tokens for phrases.
-
Query string you wish to parse and use for search.
-
Analyzer used to convert quoted text in the query string into tokens. For quoted text, this parameter overrides the analyzer specified in the
analyzerparameter. -
Suffix appended to quoted text in the query string. You can use this suffix to use a different analysis method for exact matches.
-
How to combine the queries generated from the individual search terms in the resulting
dis_maxquery. -
Values are
best_fields,most_fields,cross_fields,phrase,phrase_prefix, orbool_prefix.
-
-
Returns documents that contain terms within a provided range.
External documentation -
Hide rank_feature attributes Show rank_feature attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
Returns documents that contain terms matching a regular expression.
External documentation -
Hide rule attributes Show rule attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide script attributes Show script attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
-
Hide script_score attributes Show script_score attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Documents with a score lower than this floating point number are excluded from the search results.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide semantic attributes Show semantic attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
The field to query, which must be a semantic_text field type
-
The query text
-
-
Hide shape attributes Show shape attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
When set to
truethe query ignores an unmapped field and will not match any documents.
-
-
Hide simple_query_string attributes Show simple_query_string attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Analyzer used to convert text in the query string into tokens.
-
If
true, the query attempts to analyze wildcard terms in the query string. -
If
true, the parser creates a match_phrase query for each multi-position token. -
Values are
and,AND,or, orOR. -
Array of fields you wish to search. Accepts wildcard expressions. You also can boost relevance scores for matches to particular fields using a caret (
^) notation. Defaults to theindex.query.default_field indexsetting, which has a default value of*. -
Maximum number of terms to which the query expands for fuzzy matching.
-
Number of beginning characters left unchanged for fuzzy matching.
-
If
true, edits for fuzzy matching include transpositions of two adjacent characters (for example,abtoba). -
If
true, format-based errors, such as providing a text value for a numeric field, are ignored. -
Query string in the simple query string syntax you wish to parse and use for search.
-
Suffix appended to quoted text in the query string.
-
-
Hide span_containing attributes Show span_containing attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
-
Hide span_field_masking attributes Show span_field_masking attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
Hide span_first attributes Show span_first attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Controls the maximum end position permitted in a match.
-
-
Hide span_multi attributes Show span_multi attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide span_near attributes Show span_near attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Array of one or more other span type queries.
-
Controls whether matches are required to be in-order.
-
Controls the maximum number of intervening unmatched positions permitted.
-
-
Hide span_not attributes Show span_not attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
The number of tokens from within the include span that can’t have overlap with the exclude span. Equivalent to setting both
preandpost. -
The number of tokens after the include span that can’t have overlap with the exclude span.
-
The number of tokens before the include span that can’t have overlap with the exclude span.
-
-
Hide span_or attributes Show span_or attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Array of one or more other span type queries.
-
-
Matches spans containing a term.
External documentation -
Hide span_within attributes Show span_within attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
-
Hide sparse_vector attributes Show sparse_vector attributes object
-
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
External documentation -
Hide terms attributes Show terms attributes object
-
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
External documentation -
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
External documentation -
Supports returning text_expansion query results by sending in precomputed tokens with the query.
External documentation -
Returns documents that contain terms matching a wildcard pattern.
External documentation -
Hide wrapper attributes Show wrapper attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
A base64 encoded query. The binary data format can be any of JSON, YAML, CBOR or SMILE encodings
-
-
Hide type attributes Show type attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
-
-
If
true, the alias is hidden. All indices for the alias must have the sameis_hiddenvalue. -
If
true, the index is the write index for the alias.
-
-
-
Hide mappings attributes Show mappings attributes object
-
Hide all_field attributes Show all_field attributes object
-
Values are
strict,runtime,true, orfalse. -
-
Hide runtime attribute Show runtime attribute object
-
Hide * attributes Show * attributes object
-
For type
composite -
For type
lookup -
A custom format for
datetype runtime fields. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Hide script attributes Show script attributes object
-
Values are
boolean,composite,date,double,geo_point,geo_shape,ip,keyword,long, orlookup.
-
-
-
Values are
trueorfalse.
-
-
Hide settings attributes Show settings attributes object
-
Hide soft_deletes attributes Show soft_deletes attributes object
-
Indicates whether soft deletes are enabled on the index.
-
-
Hide sort attributes Show sort attributes object
-
Values are
true,false, orchecksum. routing_partition_size
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
Hide merge attribute Show merge attribute object
-
Hide scheduler attributes Show scheduler attributes object
max_thread_count
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
max_merge_count
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
-
Hide search attributes Show search attributes object
-
Hide slowlog attributes Show slowlog attributes object
-
Hide threshold attributes Show threshold attributes object
-
Hide query attributes Show query attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
Hide fetch attributes Show fetch attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Hide blocks attributes Show blocks attributes object
read_only
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
read_only_allow_delete
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
read
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
write
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
metadata
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
Hide analyze attribute Show analyze attribute object
max_token_count
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
Hide routing attributes Show routing attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Hide lifecycle attributes Show lifecycle attributes object
indexing_complete
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
If specified, this is the timestamp used to calculate the index age for its phase transitions. Use this setting if you create a new index that contains old data and want to use the original creation date to calculate the index age. Specified as a Unix epoch value in milliseconds.
-
Set to true to parse the origination date from the index name. This origination date is used to calculate the index age for its phase transitions. The index name must match the pattern .*-{date_format}-\d+, where the date_format is yyyy.MM.dd and the trailing digits are optional. An index that was rolled over would normally match the full format, for example logs-2016.10.31-000002). If the index name doesn’t match the pattern, index creation fails.
-
The index alias to update when the index rolls over. Specify when using a policy that contains a rollover action. When the index rolls over, the alias is updated to reflect that the index is no longer the write index. For more information about rolling indices, see Rollover.
creation_date
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
creation_date_string
string | number A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.
-
Hide translog attributes Show translog attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Values are
request,REQUEST,async, orASYNC. -
Hide retention attributes Show retention attributes object
-
-
Hide query_string attribute Show query_string attribute object
lenient
boolean | string Required Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
Hide time_series attributes Show time_series attributes object
-
Configure custom similarity settings to customize how search results are scored.
-
Hide mapping attributes Show mapping attributes object
-
Hide total_fields attributes Show total_fields attributes object
limit
number | string The maximum number of fields in an index. Field and object mappings, as well as field aliases count towards this limit. The limit is in place to prevent mappings and searches from becoming too large. Higher values can lead to performance degradations and memory issues, especially in clusters with a high load or few resources.
ignore_dynamic_beyond_limit
boolean | string This setting determines what happens when a dynamically mapped field would exceed the total fields limit. When set to false (the default), the index request of the document that tries to add a dynamic field to the mapping will fail with the message Limit of total fields [X] has been exceeded. When set to true, the index request will not fail. Instead, fields that would exceed the limit are not added to the mapping, similar to dynamic: false. The fields that were not added to the mapping will be added to the _ignored field.
-
Hide nested_fields attribute Show nested_fields attribute object
-
The maximum number of distinct nested mappings in an index. The nested type should only be used in special cases, when arrays of objects need to be queried independently of each other. To safeguard against poorly designed mappings, this setting limits the number of unique nested types per index.
-
-
Hide field_name_length attribute Show field_name_length attribute object
-
Setting for the maximum length of a field name. This setting isn’t really something that addresses mappings explosion but might still be useful if you want to limit the field length. It usually shouldn’t be necessary to set this setting. The default is okay unless a user starts to add a huge number of fields with really long names. Default is
Long.MAX_VALUE(no limit).
-
-
Hide dimension_fields attribute Show dimension_fields attribute object
-
Hide indexing.slowlog attributes Show indexing.slowlog attributes object
-
Hide threshold attribute Show threshold attribute object
-
Hide index attributes Show index attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
-
Hide indexing_pressure attribute Show indexing_pressure attribute object
-
Hide memory attribute Show memory attribute object
-
Number of outstanding bytes that may be consumed by indexing requests. When this limit is reached or exceeded, the node will reject new coordinating and primary operations. When replica operations consume 1.5x this limit, the node will reject new replica operations. Defaults to 10% of the heap.
-
-
-
Hide store attributes Show store attributes object
-
You can restrict the use of the mmapfs and the related hybridfs store type via the setting node.store.allow_mmap. This is a boolean setting indicating whether or not memory-mapping is allowed. The default is to allow it. This setting is useful, for example, if you are in an environment where you can not control the ability to create a lot of memory maps so you need disable the ability to use memory-mapping.
-
Hide defaults attributes Show defaults attributes object
-
Hide soft_deletes attributes Show soft_deletes attributes object
-
Indicates whether soft deletes are enabled on the index.
-
-
Hide sort attributes Show sort attributes object
-
Values are
true,false, orchecksum. routing_partition_size
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
Hide merge attribute Show merge attribute object
-
Hide scheduler attributes Show scheduler attributes object
max_thread_count
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
max_merge_count
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
-
Hide search attributes Show search attributes object
-
Hide slowlog attributes Show slowlog attributes object
-
Hide threshold attributes Show threshold attributes object
-
Hide query attributes Show query attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
Hide fetch attributes Show fetch attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Hide blocks attributes Show blocks attributes object
read_only
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
read_only_allow_delete
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
read
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
write
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
metadata
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
Hide analyze attribute Show analyze attribute object
max_token_count
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
Hide routing attributes Show routing attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Hide lifecycle attributes Show lifecycle attributes object
indexing_complete
boolean | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
If specified, this is the timestamp used to calculate the index age for its phase transitions. Use this setting if you create a new index that contains old data and want to use the original creation date to calculate the index age. Specified as a Unix epoch value in milliseconds.
-
Set to true to parse the origination date from the index name. This origination date is used to calculate the index age for its phase transitions. The index name must match the pattern .*-{date_format}-\d+, where the date_format is yyyy.MM.dd and the trailing digits are optional. An index that was rolled over would normally match the full format, for example logs-2016.10.31-000002). If the index name doesn’t match the pattern, index creation fails.
-
The index alias to update when the index rolls over. Specify when using a policy that contains a rollover action. When the index rolls over, the alias is updated to reflect that the index is no longer the write index. For more information about rolling indices, see Rollover.
creation_date
number | string Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
creation_date_string
string | number A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.
-
Hide translog attributes Show translog attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Values are
request,REQUEST,async, orASYNC. -
Hide retention attributes Show retention attributes object
-
-
Hide query_string attribute Show query_string attribute object
lenient
boolean | string Required Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
Hide time_series attributes Show time_series attributes object
-
Configure custom similarity settings to customize how search results are scored.
-
Hide mapping attributes Show mapping attributes object
-
Hide total_fields attributes Show total_fields attributes object
limit
number | string The maximum number of fields in an index. Field and object mappings, as well as field aliases count towards this limit. The limit is in place to prevent mappings and searches from becoming too large. Higher values can lead to performance degradations and memory issues, especially in clusters with a high load or few resources.
ignore_dynamic_beyond_limit
boolean | string This setting determines what happens when a dynamically mapped field would exceed the total fields limit. When set to false (the default), the index request of the document that tries to add a dynamic field to the mapping will fail with the message Limit of total fields [X] has been exceeded. When set to true, the index request will not fail. Instead, fields that would exceed the limit are not added to the mapping, similar to dynamic: false. The fields that were not added to the mapping will be added to the _ignored field.
-
Hide nested_fields attribute Show nested_fields attribute object
-
The maximum number of distinct nested mappings in an index. The nested type should only be used in special cases, when arrays of objects need to be queried independently of each other. To safeguard against poorly designed mappings, this setting limits the number of unique nested types per index.
-
-
Hide field_name_length attribute Show field_name_length attribute object
-
Setting for the maximum length of a field name. This setting isn’t really something that addresses mappings explosion but might still be useful if you want to limit the field length. It usually shouldn’t be necessary to set this setting. The default is okay unless a user starts to add a huge number of fields with really long names. Default is
Long.MAX_VALUE(no limit).
-
-
Hide dimension_fields attribute Show dimension_fields attribute object
-
Hide indexing.slowlog attributes Show indexing.slowlog attributes object
-
Hide threshold attribute Show threshold attribute object
-
Hide index attributes Show index attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
-
Hide indexing_pressure attribute Show indexing_pressure attribute object
-
Hide memory attribute Show memory attribute object
-
Number of outstanding bytes that may be consumed by indexing requests. When this limit is reached or exceeded, the node will reject new coordinating and primary operations. When replica operations consume 1.5x this limit, the node will reject new replica operations. Defaults to 10% of the heap.
-
-
-
Hide store attributes Show store attributes object
-
You can restrict the use of the mmapfs and the related hybridfs store type via the setting node.store.allow_mmap. This is a boolean setting indicating whether or not memory-mapping is allowed. The default is to allow it. This setting is useful, for example, if you are in an environment where you can not control the ability to create a lot of memory maps so you need disable the ability to use memory-mapping.
-
Hide lifecycle attributes Show lifecycle attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Hide downsampling attribute Show downsampling attribute object
-
The list of downsampling rounds to execute as part of this downsampling configuration
Hide rounds attributes Show rounds attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
-
If defined, it turns data stream lifecycle on/off (
true/false) for this data stream. A data stream lifecycle that's disabled (enabled:false) will have no effect on the data stream.
-
-
-
Marks this index template as deprecated. When creating or updating a non-deprecated index template that uses deprecated components, Elasticsearch will emit a deprecation warning.
PUT _component_template/component_template1
{
"template": {
"mappings": {
"properties": {
"@timestamp": {
"type": "date"
}
}
}
}
}curl \
--request POST 'http://api.example.com/_component_template/{name}' \
--header "Content-Type: application/json" \
--data '"{\n \"template\": {\n \"mappings\": {\n \"properties\": {\n \"@timestamp\": {\n \"type\": \"date\"\n }\n }\n }\n }\n}"'{
"template": {
"mappings": {
"properties": {
"@timestamp": {
"type": "date"
}
}
}
}
}{
"template": null,
"settings": {
"number_of_shards": 1
},
"mappings": {
"_source": {
"enabled": false
},
"properties": {
"host_name": {
"type": "keyword"
},
"created_at": {
"type": "date",
"format": "EEE MMM dd HH:mm:ss Z yyyy"
}
}
}
}{
"template": null,
"settings": {
"number_of_shards": 1
},
"aliases": {
"alias1": {},
"alias2": {
"filter": {
"term": {
"user.id": "kimchy"
}
},
"routing": "shard-1"
},
"{index}-alias": {}
}
}