Templates

Incoming indexes may be subject to index templates, which define how OpenSearch should process incoming data and how they should be maintained further down the road. Index templates can be single definitions ("legacy templates") or composite templates. For simplicity, this article will briefly describe legacy templates.

An index template will apply given settings to indexes at the time of creation. Templates are set up with index pattern matching, so that an index template configured for accesslog-* will be applied whenever a new index matching this pattern is created. That pattern will match index names like accesslog-000140 (typical for aliased indexes) and accesslog-2026-03-24 (typical for date-suffixed indexes).

Field types

The template may also dictate how a structured field should be cast. For instance, the (magic) field @timestamp should have a date mapping, the nested field client.ip should map to the ip type, and the nested field http.response.status_code should be mapped as an integer. OpenSearch maintains a full list of field types.

Mapping can be done in the Dashboards web UI. Navigate to Index management → Templates, and select or create a template. Mapping happens all the way to the bottom of the page, in the Index mapping section.

An important note on field mapping

If a field is not explicitly mapped to a certain type, OpenSearch will guess the data type upon the arrival of the first field in the active index. Usually it gets it right, but if something happens to a log shipper or the submitted data contains unusual content, the data type may be set incorrectly, affecting the field in question for the rest of that index' lifetime. For instance, if a data field that's usually a text field is incorrectly set to a long type, OpenSearch will reject the complete event if it arrives with non-numerical data in that field.

Aliasing

For those who wish to use index aliasing, this must also be added in the index template. This is described in the article about Aliases.