logstash-ecs-zeek-mappings_template.json

{
  "index_patterns": [
    "logstash-ecs-*"
  ],
  "order": 3,
  "version": 11,
  "mappings": {
    "_meta": {
      "version": "1.4.0-dev-bortok"
    },
    "dynamic_templates": [
      {
        "strings_as_keyword": {
          "mapping": {
            "ignore_above": 1024,
            "type": "keyword"
          },
          "match_mapping_type": "string"
        }
      }
    ],
    "date_detection": false,
    "properties": {
      "zeek": {
        "properties": {
          "uid": {
            "ignore_above": 1024,
            "type": "keyword"
          },
          "log_file": {
            "ignore_above": 1024,
            "type": "keyword"
          },
          "log_format": {
            "ignore_above": 1024,
            "type": "keyword"
          },
          "write_ts": {
            "type": "date"
          },
          "connection": {
            "properties": {
              "conn_state": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "state_msg": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "history": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "orig_bytes": {
                "type": "long"
              },
              "resp_bytes": {
                "type": "long"
              },
              "missed_bytes": {
                "type": "long"
              },
              "orig_ip_bytes": {
                "type": "long"
              },
              "resp_ip_bytes": {
                "type": "long"
              },
              "tunnel_parents": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "vlan": {
                "type": "long"
              },
              "inner_vlan": {
                "type": "long"
              }
            }
          },
          "dhcp": {
            "properties": {
              "uids": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "client_fqdn": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "domain": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "ip_requested": {
                "type": "ip"
              },
              "ip_assigned": {
                "type": "ip"
              },
              "lease_time": {
                "type": "double"
              },
              "client_message": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "server_message": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "msg_types": {
                "ignore_above": 1024,
                "type": "keyword"
              }
            }
          },
          "dns": {
            "properties": {
              "answers": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "TTLs": {
                "type": "long"
              },
              "rejected": {
                "type": "boolean"
              }
            }
          },
          "icmp": {
            "properties": {
              "type": {
                "type": "long"
              },
              "code": {
                "type": "long"
              }
            }
          },
          "ssl": {
            "properties": {
              "last_alert": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "validation_status": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "cert_chain_fuids": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "client_cert_chain_fuids": {
                "ignore_above": 1024,
                "type": "keyword"
              }
            }
          },
          "http": {
            "properties": {
              "trans_depth": {
                "type": "long"
              },
              "status_msg": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "info_code": {
                "type": "long"
              },
              "info_msg": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "tags": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "proxied": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "orig_fuids": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "orig_filenames": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "orig_mime_types": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "resp_fuids": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "resp_filenames": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "resp_mime_types": {
                "ignore_above": 1024,
                "type": "keyword"
              }
            }
          }
        }
      }
    }
  }
}