Adding an index template for the trace messages

Author: Chris Wiechmann

logstash/config/trace_messages_index_template.json

@@ -0,0 +1,27 @@
+{
+    "index_patterns": [
+        "apigw-trace-*"
+    ],
+    "settings": {
+        "number_of_shards": 5, 
+        "number_of_replicas": 2
+    },
+    "mappings": {
+        "dynamic": false,
+        "properties": {
+            "@timestamp": {
+                "type" : "date"
+            },
+            "correlationId": {
+                "type": "keyword"
+            },
+            "level": {
+                "type": "keyword"
+            },
+            "message": {
+                "type": "text", 
+                "norms": false
+            }
+        }
+    }
+}

logstash/pipeline/pipeline.conf

@@ -160,11 +160,15 @@ output {
     elasticsearch {
       hosts => "elasticsearch1:9200"
       index => "apigw-trace-messages-%{+YYYY.MM.dd}"
+      template => "${HOME}/config/trace_messages_index_template.json"
+      template_overwrite => true
     }
   } else if [logtype] == "trace" {
     elasticsearch {
       hosts => "elasticsearch1:9200"
-      index => "apigw-traffic-trace-%{+YYYY.MM.dd}"
+      index => "apigw-trace-traffic-%{+YYYY.MM.dd}"
+      template => "${HOME}/config/trace_messages_index_template.json"
+      template_overwrite => true
     }
   } else if [type] == 'errorEvent' {
     elasticsearch {