How to create component templates in Elasticsearch

Component templates reduce duplication in Elasticsearch by centralizing shared mappings and settings that should remain consistent across many indices.

Composable index templates match new indices via index_patterns and assemble the final configuration by merging the component templates listed in composed_of at index creation time.

Template updates apply only to indices created after the change, so existing indices keep their current mappings and settings until reindexed or adjusted manually. Clusters with security enabled require authentication and TLS options on API calls, and conflicting field definitions across templates can prevent indices from being created.

1. Create a component template for reusable field mappings.

   $ curl -sS -H "Content-Type: application/json" -X PUT "http://localhost:9200/_component_template/app-logs-mappings?pretty" -d '{
     "template": {
       "mappings": {
         "properties": {
           "@timestamp": { "type": "date" },
           "level": { "type": "keyword" },
           "message": { "type": "text" }
         }
       }
     },
     "version": 1,
     "_meta": {
       "description": "Shared field mappings for logs indices"
     }
   }'
   {
     "acknowledged" : true
   }

   Elasticsearch with security enabled typically requires an Authorization header (for example Authorization: ApiKey <token>) or --user credentials, plus --cacert when using HTTPS.

2. Create a component template for reusable index settings.

   $ curl -sS -H "Content-Type: application/json" -X PUT "http://localhost:9200/_component_template/app-logs-settings?pretty" -d '{
     "template": {
       "settings": {
         "index": {
           "number_of_shards": 1,
           "number_of_replicas": 1,
           "refresh_interval": "30s"
         }
       }
     },
     "version": 1,
     "_meta": {
       "description": "Shared index settings for logs indices"
     }
   }'
   {
     "acknowledged" : true
   }

3. Create an index template that composes the component templates.

   $ curl -sS -H "Content-Type: application/json" -X PUT "http://localhost:9200/_index_template/app-logs-template?pretty" -d '{
     "index_patterns": ["app-logs-*"],
     "composed_of": ["app-logs-settings", "app-logs-mappings"],
     "priority": 200,
     "version": 1,
     "_meta": {
       "description": "Applies shared logs settings and mappings via component templates"
     }
   }'
   {
     "acknowledged" : true
   }

   Overly broad index_patterns or conflicting field types across component templates can block index creation for matching indices.

4. Retrieve the component templates to confirm they are stored.

   $ curl -sS "http://localhost:9200/_component_template/app-logs-*?pretty"
   {
     "component_templates" : [
       {
         "name" : "app-logs-mappings",
         "component_template" : {
           "template" : {
             "mappings" : {
               "properties" : {
                 "@timestamp" : {
                   "type" : "date"
                 },
                 "level" : {
                   "type" : "keyword"
                 },
                 "message" : {
                   "type" : "text"
                 }
               }
             }
           },
           "version" : 1,
           "_meta" : {
             "description" : "Shared field mappings for logs indices"
           }
         }
       },
       {
         "name" : "app-logs-settings",
         "component_template" : {
           "template" : {
             "settings" : {
               "index" : {
                 "number_of_shards" : "1",
                 "number_of_replicas" : "1",
                 "refresh_interval" : "30s"
               }
             }
           },
           "version" : 1,
           "_meta" : {
             "description" : "Shared index settings for logs indices"
           }
         }
       }
     ]
   }

5. Simulate the resolved template for a matching index name.

   $ curl -sS -X POST "http://localhost:9200/_index_template/_simulate_index/app-logs-000001?pretty"
   {
     "template" : {
       "settings" : {
         "index" : {
           "routing" : {
             "allocation" : {
               "include" : {
                 "_tier_preference" : "data_content"
               }
             }
           },
           "refresh_interval" : "30s",
           "number_of_shards" : "1",
           "number_of_replicas" : "1"
         }
       },
       "mappings" : {
         "properties" : {
           "@timestamp" : {
             "type" : "date"
           },
           "level" : {
             "type" : "keyword"
           },
           "message" : {
             "type" : "text"
           }
         }
       },
       "aliases" : { }
     },
     "overlapping" : [ ]
   }

   Simulation previews the merged mappings and settings without creating an index.

6. Create a test index to verify template application.

   $ curl -sS -X PUT "http://localhost:9200/app-logs-000001?pretty"
   {
     "acknowledged" : true,
     "shards_acknowledged" : true,
     "index" : "app-logs-000001"
   }

7. Retrieve the test index mapping to confirm field types.

   $ curl -sS "http://localhost:9200/app-logs-000001/_mapping?pretty"
   {
     "app-logs-000001" : {
       "mappings" : {
         "properties" : {
           "@timestamp" : {
             "type" : "date"
           },
           "level" : {
             "type" : "keyword"
           },
           "message" : {
             "type" : "text"
           }
         }
       }
     }
   }

8. Retrieve the test index settings to confirm template settings.

   $ curl -sS "http://localhost:9200/app-logs-000001/_settings?flat_settings=true&pretty"
   {
     "app-logs-000001" : {
       "settings" : {
         "index.creation_date" : "##### snipped #####",
         "index.number_of_replicas" : "1",
         "index.number_of_shards" : "1",
         "index.provided_name" : "app-logs-000001",
         "index.refresh_interval" : "30s",
         "index.routing.allocation.include._tier_preference" : "data_content",
         "index.uuid" : "##### snipped #####",
         "index.version.created" : "##### snipped #####"
       }
     }
   }

   index.number_of_shards is fixed at creation time, while index.number_of_replicas is adjustable later.

9. Delete the test index to remove the verification artifact.

   $ curl -sS -X DELETE "http://localhost:9200/app-logs-000001?pretty"
   {
     "acknowledged" : true
   }

   Deleting an index permanently removes its data.