title: Logstash / Elasticsearch: "Failed to install template" / " Got response code '400' "
body: <p>I'm new with ELK stack, i'm trying to install a template from logstash output.elasticsearch but when i'm put a &quot;mappings&quot; key in my JSON i have this issue:</p>
  <pre><code>[2020-09-12T15:19:04,321][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=&gt;&quot;Got response code '400' contacting Elasticsearch at URL 'http://elasticsearch:9200/_template/maillog'&quot;, :class=&gt;&quot;LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError&quot;, :backtrace=&gt;[&quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:80:in `perform_request'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in `perform_request_to_url'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:278:in `block in perform_request'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in `with_connection'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:277:in `perform_request'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in `block in Pool'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:352:in `template_put'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:86:in `template_install'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/template_manager.rb:28:in `install'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/template_manager.rb:16:in `install_template'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:130:in `install_template'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:51:in `block in setup_after_successful_connection'&quot;]}
  </code></pre>
  <p>Here my JSON template:</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;index_patterns&quot;: &quot;*-maillog-*&quot;,
    &quot;settings&quot;: {
      &quot;index&quot;: {
        &quot;refresh_interval&quot;: &quot;10s&quot;,
        &quot;number_of_shards&quot;: 1,
        &quot;number_of_replicas&quot;: 0
      }
    },
    &quot;mappings&quot;: {
      &quot;maillog&quot;: {
        &quot;properties&quot;: {
          &quot;ip&quot;: { &quot;type&quot;: &quot;ip&quot; }
        }
      }
    }
  }
  
  </code></pre>
  <p>Here my output.elasticsearch:</p>
  <pre class="lang-json prettyprint-override"><code>output {
       elasticsearch {
          id =&gt; &quot;test&quot;
          index =&gt; &quot;%{[product]}-maillog-%{+YYYY.MM.dd}&quot;
          hosts =&gt; [&quot;###ELASTIC_HOST###:9200&quot;]
          document_type =&gt; &quot;maillog&quot;
          manage_template =&gt; true
          template_overwrite =&gt; true
          template =&gt; &quot;${CONF_PATH}/mapping/maillog.json&quot;
          template_name =&gt; &quot;maillog&quot;
        }
  }
  </code></pre>
  <p>With this conf elastic can't create my template but if i remove &quot;mappings&quot; key from the template, like this:</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;index_patterns&quot;: &quot;*-maillog-*&quot;,
    &quot;settings&quot;: {
      &quot;index&quot;: {
        &quot;refresh_interval&quot;: &quot;10s&quot;,
        &quot;number_of_shards&quot;: 1,
        &quot;number_of_replicas&quot;: 0
      }
    }
  }
  
  </code></pre>
  <p>There is no issue anymore.</p>
  <p>My stack is composed from 3 containers :</p>
  <pre><code>elasticsearch 7.4.2
  
  logstash 7.4.2
  
  kibana 7.4.2
  </code></pre>
  <p>I'm probably missing something, but many hours spent and no clue to resolve this issue...</p>
  <p>Thanks for your help</p>