No longer use legacy index templates

Author: ba0708

Mapping & Analysis/index-templates.md

@@ -1,39 +1,102 @@
 # Index templates
 
-## Adding an index template named `access-logs`
+## Adding/updating an index template
+
+This adds a new index template or updates an existing one.
+
 ```
-PUT /_template/access-logs
+PUT /_index_template/access-logs
 {
   "index_patterns": ["access-logs-*"],
+  "template": {
+    "settings": {
+      "number_of_shards": 2,
+      "index.mapping.coerce": false
+    },
+    "mappings": {
+      "properties": {
+        "@timestamp": { "type": "date" },
+        "url.original": { "type": "wildcard" },
+        "url.path": { "type": "wildcard" },
+        "url.scheme": { "type": "keyword" },
+        "url.domain": { "type": "keyword" },
+        "client.geo.continent_name": { "type": "keyword" },
+        "client.geo.country_name": { "type": "keyword" },
+        "client.geo.region_name": { "type": "keyword" },
+        "client.geo.city_name": { "type": "keyword" },
+        "user_agent.original": { "type": "keyword" },
+        "user_agent.name": { "type": "keyword" },
+        "user_agent.version": { "type": "keyword" },
+        "user_agent.device.name": { "type": "keyword" },
+        "user_agent.os.name": { "type": "keyword" },
+        "user_agent.os.version": { "type": "keyword" }
+      }
+    }
+  }
+}
+```
+
+## Indexing a document into a new index
+
+The index name matches the index pattern defined within the above index template. 
+The index template's settings and mappings will be therefore be applied to the new index.
+
+```
+POST /access-logs-2023-01/_doc
+{
+  "@timestamp": "2023-01-01T00:00:00Z",
+  "url.original": "https://example.com/products",
+  "url.path": "/products",
+  "url.scheme": "https",
+  "url.domain": "example.com",
+  "client.geo.continent_name": "Europe",
+  "client.geo.country_name": "Denmark",
+  "client.geo.region_name": "Capital City Region",
+  "client.geo.city_name": "Copenhagen",
+  "user_agent.original": "Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1",
+  "user_agent.name": "Safari",
+  "user_agent.version": "12.0",
+  "user_agent.device.name": "iPhone",
+  "user_agent.os.name": "iOS",
+  "user_agent.os.version": "12.1.0"
+}
+```
+
+## Manually creating an index
+
+The index template's settings/mappings will also be applied to this index.
+
+```
+PUT /access-logs-2023-02
+{
   "settings": {
-    "number_of_shards": 2,
-    "index.mapping.coerce": false
-  }, 
+    "number_of_shards": 1
+  },
   "mappings": {
     "properties": {
-      "@timestamp": {
-        "type": "date"
-      },
-      "url.original": {
-        "type": "keyword"
-      },
-      "http.request.referrer": {
+      "url.query": {
         "type": "keyword"
-      },
-      "http.response.status_code": {
-        "type": "long"
       }
     }
   }
 }
 ```
 
-## Adding an index matching the index template's pattern
+## Inspecting the new indices
+
+```
+GET /access-logs-2023-01
+GET /access-logs-2023-02
+```
+
+## Retrieving an index template
+
 ```
-PUT /access-logs-2020-01-01
+GET /_index_template/access-logs
 ```
 
-## Verify that the mapping is applied
+## Deleting an index template
+
 ```
-GET /access-logs-2020-01-01
+DELETE /_index_template/access-logs
 ```