File size: 3,080 Bytes
7c89ed7 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 | {
"order": 0,
"index_patterns": [
["events*", "alerts*"]
],
"settings": {},
"mappings": {
"_doc": {
"date_detection": false,
"dynamic_templates": [
{
"string_fields": {
"mapping": {
"type": "keyword"
},
"match": "*",
"match_mapping_type": "string"
}
},
{
"binary_fields": {
"mapping": {
"type": "keyword"
},
"match": "*",
"match_mapping_type": "binary"
}
},
{
"double_fields": {
"mapping": {
"type": "keyword"
},
"match": "*",
"match_mapping_type": "double"
}
},
{
"long_fields": {
"mapping": {
"type": "keyword"
},
"match": "*",
"match_mapping_type": "long"
}
}
],
"properties": {
"type": {
"type": "keyword"
},
"category": {
"type": "keyword"
},
"hostname": {
"type": "keyword"
},
"processid": {
"type": "keyword"
},
"processname": {
"type": "keyword"
},
"severity": {
"type": "keyword"
},
"source": {
"type": "keyword"
},
"summary": {
"type": "text"
},
"details": {
"properties": {
"sourceipaddress": {
"type": "ip"
},
"sourceipv4address": {
"type": "keyword"
},
"destinationipaddress": {
"type": "ip"
},
"destinationport": {
"type": "keyword"
},
"destinationipgeopoint": {
"type": "geo_point"
},
"sourceipgeopoint": {
"type": "geo_point"
},
"success": {
"type": "boolean"
},
"sourceport": {
"type": "keyword"
},
"apiversion": {
"properties": {
"raw_value": {
"type": "keyword"
}
}
},
"requestparameters": {
"properties": {
"logstreamname": {
"properties": {
"raw_value": {
"type": "keyword"
}
}
}
}
}
}
},
"receivedtimestamp": {
"format": "dateOptionalTime",
"type": "date"
},
"timestamp": {
"format": "dateOptionalTime",
"type": "date"
},
"utctimestamp": {
"format": "dateOptionalTime",
"type": "date"
},
"version": {
"type": "keyword"
}
}
}
},
"aliases": {}
}
|