From 1f71816ad72be6e0e16b3db6ea8d042a92d65ae1 Mon Sep 17 00:00:00 2001
From: Wes Lambert <wlambertts@gmail.com>
Date: Thu, 3 Mar 2022 14:54:30 +0000
Subject: [PATCH] Add keyword subfield for DTC winlog mappings

---
 .../templates/component/so/dtc-winlog-mappings.json         | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/salt/elasticsearch/templates/component/so/dtc-winlog-mappings.json b/salt/elasticsearch/templates/component/so/dtc-winlog-mappings.json
index dbf4e169a..09c157c1e 100644
--- a/salt/elasticsearch/templates/component/so/dtc-winlog-mappings.json
+++ b/salt/elasticsearch/templates/component/so/dtc-winlog-mappings.json
@@ -55,6 +55,9 @@
                 "security": {
                   "type": "text",
                   "analyzer": "es_security_analyzer"
+                },
+		"keyword": {
+                  "type": "keyword"
                 }
               }
             },
@@ -65,6 +68,9 @@
                 "security": {
                   "type": "text",
                   "analyzer": "es_security_analyzer"
+                },
+		"keyword": {
+                  "type": "keyword"
                 }
               }
             }