CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 10:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add .keyword subfield for conflict fields

Browse Source
This commit is contained in:
weslambert
2021-10-21 12:56:03 -04:00
committed by GitHub
parent 59852841ff
commit 77ee1db44c
1 changed files with 129 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

150
salt/elasticsearch/templates/so/so-endgame-template.json.jinja
View File

@@ -26,23 +26,48 @@
"properties": { "properties": {
"ephemeral_id": { "ephemeral_id": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"id": { "id": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"name": { "name": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"type": { "type": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"version": { "version": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
} }
} }
}, },
@@ -597,7 +622,12 @@
"properties": { "properties": {
"version": { "version": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
} }
} }
}, },
@@ -683,18 +713,33 @@
}, },
"category": { "category": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"code": { "code": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword"
}, },
"created": { "created": {
"type": "date" "type": "date",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"dataset": { "dataset": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"duration": { "duration": {
"type": "long" "type": "long"
@@ -711,7 +756,12 @@
"type": "keyword" "type": "keyword"
}, },
"ingested": { "ingested": {
"type": "date" "type": "date",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"kind": { "kind": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -734,7 +784,12 @@
}, },
"outcome": { "outcome": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"provider": { "provider": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -761,11 +816,21 @@
}, },
"timezone": { "timezone": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"type": { "type": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"url": { "url": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -1011,7 +1076,12 @@
}, },
"name": { "name": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"os": { "os": {
"properties": { "properties": {
@@ -1144,11 +1214,21 @@
}, },
"method": { "method": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"referrer": { "referrer": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
} }
} }
}, },
@@ -1192,7 +1272,12 @@
"properties": { "properties": {
"level": { "level": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"logger": { "logger": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -2154,7 +2239,12 @@
}, },
"name": { "name": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"node": { "node": {
"properties": { "properties": {
@@ -2170,7 +2260,12 @@
}, },
"type": { "type": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"version": { "version": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -2182,7 +2277,12 @@
"properties": { "properties": {
"address": { "address": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"as": { "as": {
"properties": { "properties": {
@@ -2338,7 +2438,12 @@
}, },
"tags": { "tags": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"threat": { "threat": {
"properties": { "properties": {
@@ -2689,6 +2794,9 @@
}, },
"original": { "original": {
"fields": { "fields": {
"keyword": {
"type": "keyword"
},
"text": { "text": {
"norms": false, "norms": false,
"type": "text" "type": "text"