How to create and manage index templates in Elasticsearch

Index templates in Elasticsearch keep new indices consistent by automatically applying default settings, mappings, and aliases based on the index name. Consistent defaults reduce mapping conflicts, control shard counts, and prevent accidental field type changes that can break ingestion.

Modern Elasticsearch uses composable templates stored and managed through the /_index_template API. Each template matches one or more index_patterns and contributes configuration under the template section, optionally pulling shared building blocks from component templates via composed_of.

Templates apply only when an index or data stream is created, leaving existing indices unchanged. Patterns that are too broad can unintentionally affect unrelated indices, so simulating template resolution before creating indices makes overlaps and priority behavior visible. Secured clusters require authentication and HTTPS, and creating or updating templates requires a cluster privilege such as manage_index_templates.

Steps to create and manage index templates in Elasticsearch:

Create an index template for log indices.

$ curl -s -H "Content-Type: application/json" -X PUT "http://localhost:9200/_index_template/logs-default?pretty" -d '{
  "index_patterns": ["logs-*"],
  "priority": 200,
  "version": 1,
  "_meta": {
    "description": "Defaults for logs indices"
  },
  "template": {
    "settings": { "number_of_shards": 1 },
    "mappings": {
      "properties": {
        "timestamp": { "type": "date" },
        "level": { "type": "keyword" },
        "message": { "type": "text" }
      }
    }
  }
}'
{
  "acknowledged" : true
}

PUT to an existing template name replaces its definition. Adding "data_stream": {} at the top level makes the template eligible for matching data streams.

Simulate template resolution for a prospective index name.

$ curl -s -X POST "http://localhost:9200/_index_template/_simulate_index/logs-2025.01?filter_path=template&pretty"
{
  "template" : {
    "settings" : {
      "index" : {
        "number_of_shards" : "1",
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        }
      }
    },
    "mappings" : {
      "properties" : {
        "level" : {
          "type" : "keyword"
        },
        "message" : {
          "type" : "text"
        },
        "timestamp" : {
          "type" : "date"
        }
      }
    },
    "aliases" : { }
  }
}

Multiple templates can match the same index name, with higher priority winning for conflicting settings. Removing filter_path exposes the overlapping_templates list for overlap troubleshooting.

Create a test index that matches the template pattern.
```
$ curl -s -X PUT "http://localhost:9200/logs-2025.01?pretty"
{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "logs-2025.01"
}
```
Index templates apply at index creation time, so creating the index is a practical validation beyond simulation output.

Verify the shard setting applied to the new index.

$ curl -s "http://localhost:9200/logs-2025.01/_settings?filter_path=*.settings.index.number_of_shards&pretty"
{
  "logs-2025.01" : {
    "settings" : {
      "index" : {
        "number_of_shards" : "1"
      }
    }
  }
}

Verify the field mappings applied to the new index.

$ curl -s "http://localhost:9200/logs-2025.01/_mapping?filter_path=*.mappings.properties&pretty"
{
  "logs-2025.01" : {
    "mappings" : {
      "properties" : {
        "level" : {
          "type" : "keyword"
        },
        "message" : {
          "type" : "text"
        },
        "timestamp" : {
          "type" : "date"
        }
      }
    }
  }
}

Retrieve the stored template definition for review.

$ curl -s "http://localhost:9200/_index_template/logs-default?pretty"
{
  "index_templates" : [
    {
      "name" : "logs-default",
      "index_template" : {
        "index_patterns" : [
          "logs-*"
        ],
        "template" : {
          "settings" : {
            "index" : {
              "number_of_shards" : "1"
            }
          },
          "mappings" : {
            "properties" : {
              "level" : {
                "type" : "keyword"
              },
              "message" : {
                "type" : "text"
              },
              "timestamp" : {
                "type" : "date"
              }
            }
          }
        },
        "composed_of" : [ ],
        "priority" : 200,
        "version" : 1,
        "_meta" : {
          "description" : "Defaults for logs indices"
        }
      }
    }
  ]
}

Update the template by re-submitting it with a higher version.

$ curl -s -H "Content-Type: application/json" -X PUT "http://localhost:9200/_index_template/logs-default?pretty" -d '{
  "index_patterns": ["logs-*"],
  "priority": 200,
  "version": 2,
  "_meta": {
    "description": "Defaults for logs indices"
  },
  "template": {
    "settings": { "number_of_shards": 1 },
    "mappings": {
      "properties": {
        "timestamp": { "type": "date" },
        "level": { "type": "keyword" },
        "message": { "type": "text" }
      }
    },
    "aliases": {
      "logs-search": {}
    }
  }
}'
{
  "acknowledged" : true
}

Updating an index template affects only indices created after the update, leaving existing indices unchanged.

List templates that match the logs-* pattern.

$ curl -s "http://localhost:9200/_index_template/logs-*?filter_path=index_templates.name&pretty"
{
  "index_templates" : [
    {
      "name" : "logs-default"
    }
  ]
}

Remove a template that is no longer needed.
```
$ curl -s -X DELETE "http://localhost:9200/_index_template/logs-default?pretty"
{
  "acknowledged" : true
}
```
Deleting an index template stops its defaults from applying to newly created indices matching the pattern.
Delete the test index used for verification.
```
$ curl -s -X DELETE "http://localhost:9200/logs-2025.01?pretty"
{
  "acknowledged" : true
}
```
Deleting an index permanently removes its documents.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.