Template creation is one of the most important features in Elasticsearch. It is used extensively with time-based data indexing. The main reason why we employ template creation for indexing is that most of the time, we would use our custom settings and mappings for different sets of data. Index templating allows us define default settings for indices by providing an index name pattern. So, let's assume that we have an index per day and the format is logstash-YYYY-MM-DD. Let's say, we want an index with only 2 shards and not 5 shards, which is the default. We can assign a template to the logstash-* pattern. Every time a document is inserted and when the index for the document is missing, the pattern will take the default value from the template. Let's see how a template is created:
curl -XPUT localhost:9200/_template/logstash -d '{
"template": "logstash-*",
"order": 0,
"settings": {
"number_of_shards": 2
},
"mappings": {
"logs": {
"_source": ...
