Docs to manually loading template in 6.0

[andrewkroh]

The documentation for manually loading index templates only works if you are using the ES output. The users that most commonly need to manually load the index templates are users of non-ES outputs.

To accomplish this task you need to disable the Logstash output and manually enable ES on the CLI.

filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'

Alternatively you can export the template to a file and use curl or Invoke-RestMethod. This is useful if the host running Beats does not have direct connectivity to ES.

Windows:

# Write the template to disk.
PS> .\winlogbeat.exe export template --es.version 6.0.0 | Out-File -Encoding UTF8 winlogbeat.template.json

# Install it to ES.
PS > Invoke-RestMethod -Method Put -ContentType "application/json" -InFile winlogbeat.template.json -Uri http://elasticsearch:9200/_template/winlogbeat-6.0.0

Unix:

filebeat export template > filebeat.template.json

curl -XPUT -H 'Content-Type: application/json' http://elasticsearch:9200/_template/filebeat-6.0.0 -d@filebeat.template.json