Index templates in Elasticsearch specify index mappings, settings, and aliases.
Component templates are building blocks for constructing index templates.
An index template can be composed of multiple component templates. To use a component template, specify it in an index template’s composed_of list.
Both index and component templates can be managed (created by Elasticsearch by default) and custom (created later, by users).
Automatic Component Template Matching
Key Mechanism: Custom Template Integration
Elasticsearch uses a pattern-based auto-matching for component templates. Component templates with a shared prefix can be automatically applied to matching index templates. This is different from manual explicit addition to composed_of.
Matching Rules
Component templates are matched based on their naming prefix. Index templates with similar prefixes automatically incorporate these component templates. The matching is done through an intelligent, behind-the-scenes process.
Example Scenario
Any index template whose name starts with "traces-" will automatically pick up the managed component templates "traces@settings" and "traces@mappings", as well as the custom component template "traces@custom" if it exists. This behavior is based on Elasticsearch's composable index template system and naming conventions.
Elasticsearch automatically creates managed index templates for various data types, including traces. These templates typically include references to managed component templates like "traces@settings" and "traces@mappings". The managed index templates also include a reference to a custom component template named "traces@custom" by default, even if it doesn't exist initially.
Automatic Pickup: When we create a custom component template named traces@custom, it is automatically integrated into the existing index template without requiring manual addition to the composed_of list.
When a new index matching the pattern defined in the index template (e.g., traces-*) is created, Elasticsearch applies all the referenced component templates, including the custom one.
Component Template: traces@custom
Matching Index Templates:
- traces-apm.sampled
- traces-apm.rum
- traces-apm.backend
- traces-...
How Auto-Matching Works
When a component template is created with a specific prefix, Elasticsearch scans existing index templates. It automatically adds the component template to index templates with matching prefixes. This happens without manually updating the composed_of list.
The automatic prefix-based matching applies to:
- Elasticsearch-managed (built-in) templates (e.g., metrics, logs, APM templates)
- User-created managed index templates (created via _index_template API)
It does NOT apply to legacy index templates created with the older _template API.
So when we added traces@custom and saw it automatically applied to multiple index templates like traces-apm.sampled, we were seeing the matching against Elasticsearch's managed templates and user-created managed templates.
When a component template is created (e.g., traces@custom):
- Elasticsearch scans ALL existing index templates
- Automatically adds the component template to matching index templates
- Matching is based on prefix, regardless of template origin.
Naming Convention Impact
Prefix matching is crucial.
traces@custom will match templates starting with traces-.
metrics@custom would match metrics- prefixed templates.
Prefix-based matching is a system-wide feature, not limited to custom or user-created templates. It applies uniformly across all managed index templates.
This system allows for easy customization of index settings and mappings without modifying the managed templates directly. It's important to note that while custom templates are automatically picked up, they must still be created manually if you want to add custom configurations.
---
