CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

store related event data as a flattened object blob

Browse Source
This commit is contained in:
Jason Ertel
2022-01-26 12:16:05 -05:00
parent eefcc929c2
commit ed9b74dc33
1 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
salt/elasticsearch/templates/so/so-case-template.json.jinja
View File

@@ -22,17 +22,6 @@
}, },
"dynamic": false, "dynamic": false,
"date_detection": false, "date_detection": false,
"dynamic_templates": [
{
"strings_as_keyword": {
"mapping": {
"ignore_above": 1024,
"type": "keyword"
},
"match_mapping_type": "string"
}
}
],
"properties": { "properties": {
"@timestamp": { "@timestamp": {
"type": "date" "type": "date"
@@ -221,6 +210,15 @@
"createTime": { "createTime": {
"type": "date" "type": "date"
}, },
"fields": {
"eager_global_ordinals": false,
"ignore_above": 1024,
"index": true,
"type": "flattened",
"index_options": "docs",
"split_queries_on_whitespace": false,
"doc_values": true
},
"userId": { "userId": {
"type": "keyword", "type": "keyword",
"ignore_above": 1024 "ignore_above": 1024