title: Logstash -> Elasticsearch Not Mapping Correctly
body: <p>So I recently created an ELK cluster using this site as a template for doing so.<a href="http://everythingshouldbevirtual.com/highly-available-elk-elasticsearch-logstash-kibana-setup" rel="nofollow">ELK Cluster Setup</a></p>
  
  <p>I am running into a problem where the json template on the Logstash processing node isn't being used on the actual Elasticsearch data nodes. I can see the mapping has been created in HQ but another one was created that is using some dynamically created mappings. The mapping that is done right is called "Sourcefire" on the data nodes, but it also created one called "sourcfire" that isn't right. </p>
  
  <p>I can't figure this out and I'm learning this stuff so any help is appreciated. See below for code snippets. </p>
  
  <p>Logstash.conf</p>
  
  <pre><code>input {
      tcp {
          port =&gt; 5170
          type =&gt; "sourcefire"
      }
  }
  
  filter {
  
      mutate{
          split =&gt; ["message", "|"]
          add_field =&gt; {
              "event" =&gt; "%{message[5]}"
              "eventSource" =&gt; "%{message[1]}"
          }
      }
  
      kv {
          include_keys =&gt; ["dhost", "dst", "dpt", "shost", "src", "spt", "rt"]
      }
  
      mutate {
          rename =&gt; [ "dhost", "destinationHost" ]
          rename =&gt; [ "dst", "destinationAddress" ]
          rename =&gt; [ "dpt", "destinationPort" ]
          rename =&gt; [ "shost", "sourceHost" ]
          rename =&gt; [ "src", "sourceAddress" ]
          rename =&gt; [ "spt", "sourcePort" ]
      }
  
      date {
          match =&gt; ["rt","UNIX_MS"]
          target =&gt; "eventDate"
      }
  
      geoip {
          add_tag =&gt; [ "sourceGeo" ]
          source =&gt; "src"
          database =&gt; "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
      }
  
      geoip {
          add_tag =&gt; [ "destinationGeo" ]
          source =&gt; "src"
          database =&gt; "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
      }
  }
  
  output {
      if [type] == "sourcefire" {
          elasticsearch {
              cluster =&gt; "XXX-cluster"
              flush_size =&gt; 1
              manage_template =&gt; true
              template =&gt; "/opt/logstash/lib/logstash/outputs/elasticsearch/elasticsearch-sourcefire.json"
          }
      }
  }
  </code></pre>
  
  <p>Elasticsearch json template</p>
  
  <pre><code>{
      "template": "logstash-*",
      "settings": {
          "index.refresh_interval": "5s"
      },
      "mappings": {
          "Sourcefire": {
              "_all": {
                  "enabled": true
              },
              "properties": {
                  "@timestamp": {
                      "type": "date",
                      "format": "basicDateTimeNoMillis"
                  },
                  "@version": {
                      "type": "string",
                      "index": "not_analyzed"
                  },
                  "geoip": {
                      "type": "object",
                      "dynamic": true,
                      "path": "full",
                      "properties": {
                          "location": {
                              "type": "geo_point"
                          }
                      }
                  },
                  "event": {
                      "type": "string",
                      "index": "not_analyzed"
                  },
                  "eventDate": {
                      "type": "date",
                      "format": "basicDateTimeNoMillis"
                  },
                  "destinationAddress": {
                      "type": "ip"
                  },
                  "destinationHost": {
                      "type": "string",
                      "index": "not_analyzed"
                  },
                  "destinationPort": {
                      "type": "integer",
                      "index": "not_analyzed"
                  },
                  "sourceAddress": {
                      "type": "ip"
                  },
                  "sourceHost": {
                      "type": "string",
                      "index": "not_analyzed"
                  },
                  "sourcePort": {
                      "type": "integer",
                      "index": "not_analyzed"
                  }
              }
          }
      }
  }
  </code></pre>