{
  "_meta": {
    "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html",
    "ecs_version": "1.12.2"
  },
  "template": {
    "mappings": {
      "properties": {
        "fortinet": {
          "properties": {
            "file": {
              "properties": {
                "hash": {
                  "properties": {
                    "crc32": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "firewall": {
              "properties": {
                "acct_stat": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "acktime": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "act": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "action": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "activity": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "addr": {
                  "type": "ip"
                },
                "addr_type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "addrgrp": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "adgroup": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "admin": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "age": {
                  "type": "long"
                },
                "agent": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "alarmid": {
                  "type": "long"
                },
                "alert": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "analyticscksum": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "analyticssubmit": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ap": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "app-type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "appact": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "appid": {
                  "type": "long"
                },
                "applist": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "apprisk": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "apscan": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "apsn": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "apstatus": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "aptype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "assigned": {
                  "type": "ip"
                },
                "assignip": {
                  "type": "ip"
                },
                "attachment": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "attack": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "attackcontext": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "attackcontextid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "attackid": {
                  "type": "long"
                },
                "auditid": {
                  "type": "long"
                },
                "auditscore": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "audittime": {
                  "type": "long"
                },
                "authgrp": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "authid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "authproto": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "authserver": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "bandwidth": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "banned_rule": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "banned_src": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "banword": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "botnetdomain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "botnetip": {
                  "type": "ip"
                },
                "bssid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "call_id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "carrier_ep": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cat": {
                  "type": "long"
                },
                "category": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cc": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cdrcontent": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "centralnatid": {
                  "type": "long"
                },
                "cert": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cert-type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "certhash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cfgattr": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cfgobj": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cfgpath": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cfgtid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cfgtxpower": {
                  "type": "long"
                },
                "channel": {
                  "type": "long"
                },
                "channeltype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "chassisid": {
                  "type": "long"
                },
                "checksum": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "chgheaders": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cldobjid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "client_addr": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cloudaction": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "clouduser": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "column": {
                  "type": "long"
                },
                "command": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "community": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "configcountry": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "connection_type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "conserve": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "constraint": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "contentdisarmed": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "contenttype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "cookies": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "count": {
                  "type": "long"
                },
                "countapp": {
                  "type": "long"
                },
                "countav": {
                  "type": "long"
                },
                "countcifs": {
                  "type": "long"
                },
                "countdlp": {
                  "type": "long"
                },
                "countdns": {
                  "type": "long"
                },
                "countemail": {
                  "type": "long"
                },
                "countff": {
                  "type": "long"
                },
                "countips": {
                  "type": "long"
                },
                "countssh": {
                  "type": "long"
                },
                "countssl": {
                  "type": "long"
                },
                "countwaf": {
                  "type": "long"
                },
                "countweb": {
                  "type": "long"
                },
                "cpu": {
                  "type": "long"
                },
                "craction": {
                  "type": "long"
                },
                "criticalcount": {
                  "type": "long"
                },
                "crl": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "crlevel": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "crscore": {
                  "type": "long"
                },
                "cveid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "daemon": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "datarange": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "date": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ddnsserver": {
                  "type": "ip"
                },
                "desc": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "detectionmethod": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "devcategory": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "devintfname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "devtype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dhcp_msg": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dintf": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "disk": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "disklograte": {
                  "type": "long"
                },
                "dlpextra": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "docsource": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "domainctrlauthstate": {
                  "type": "long"
                },
                "domainctrlauthtype": {
                  "type": "long"
                },
                "domainctrldomain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "domainctrlip": {
                  "type": "ip"
                },
                "domainctrlname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "domainctrlprotocoltype": {
                  "type": "long"
                },
                "domainctrlusername": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "domainfilteridx": {
                  "type": "long"
                },
                "domainfilterlist": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ds": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dst_int": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstcountry": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstdevcategory": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstdevtype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstfamily": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dsthwvendor": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dsthwversion": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstinetsvc": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstintfrole": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstosname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstosversion": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstserver": {
                  "type": "long"
                },
                "dstssid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstswversion": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstunauthusersource": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "dstuuid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "duid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "eapolcnt": {
                  "type": "long"
                },
                "eapoltype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "encrypt": {
                  "type": "long"
                },
                "encryption": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "epoch": {
                  "type": "long"
                },
                "espauth": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "esptransform": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "eventtype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "exch": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "exchange": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "expectedsignature": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "expiry": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "fams_pause": {
                  "type": "long"
                },
                "fazlograte": {
                  "type": "long"
                },
                "fctemssn": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "fctuid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "field": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "filefilter": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "filehashsrc": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "filtercat": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "filteridx": {
                  "type": "long"
                },
                "filtername": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "filtertype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "fortiguardresp": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "forwardedfor": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "fqdn": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "frametype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "freediskstorage": {
                  "type": "long"
                },
                "from": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "from_vcluster": {
                  "type": "long"
                },
                "fsaverdict": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "fwserver_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "gateway": {
                  "type": "ip"
                },
                "green": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "groupid": {
                  "type": "long"
                },
                "ha-prio": {
                  "type": "long"
                },
                "ha_group": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ha_role": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "handshake": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "hbdn_reason": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "highcount": {
                  "type": "long"
                },
                "host": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "iaid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "icmpcode": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "icmpid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "icmptype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "identifier": {
                  "type": "long"
                },
                "in_spi": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "incidentserialno": {
                  "type": "long"
                },
                "infected": {
                  "type": "long"
                },
                "infectedfilelevel": {
                  "type": "long"
                },
                "informationsource": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "init": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "initiator": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "interface": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "intf": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "invalidmac": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ip": {
                  "type": "ip"
                },
                "iptype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "keyword": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "kind": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "lanin": {
                  "type": "long"
                },
                "lanout": {
                  "type": "long"
                },
                "lease": {
                  "type": "long"
                },
                "license_limit": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "limit": {
                  "type": "long"
                },
                "line": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "live": {
                  "type": "long"
                },
                "local": {
                  "type": "ip"
                },
                "log": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "login": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "lowcount": {
                  "type": "long"
                },
                "mac": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "malform_data": {
                  "type": "long"
                },
                "malform_desc": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "manuf": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "masterdstmac": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "mastersrcmac": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "mediumcount": {
                  "type": "long"
                },
                "mem": {
                  "type": "long"
                },
                "meshmode": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "message_type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "method": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "mgmtcnt": {
                  "type": "long"
                },
                "mode": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "module": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "monitor-name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "monitor-type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "mpsk": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "msgproto": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "mtu": {
                  "type": "long"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "nat": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "netid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "new_status": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "new_value": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "newchannel": {
                  "type": "long"
                },
                "newchassisid": {
                  "type": "long"
                },
                "newslot": {
                  "type": "long"
                },
                "nextstat": {
                  "type": "long"
                },
                "nf_type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "noise": {
                  "type": "long"
                },
                "old_status": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "old_value": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "oldchannel": {
                  "type": "long"
                },
                "oldchassisid": {
                  "type": "long"
                },
                "oldslot": {
                  "type": "long"
                },
                "oldsn": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "oldwprof": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "onwire": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "opercountry": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "opertxpower": {
                  "type": "long"
                },
                "osname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "osversion": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "out_spi": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "outintf": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "passedcount": {
                  "type": "long"
                },
                "passwd": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "path": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "peer": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "peer_notif": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "phase2_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "phone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "pid": {
                  "type": "long"
                },
                "policytype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "poolname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "port": {
                  "type": "long"
                },
                "portbegin": {
                  "type": "long"
                },
                "portend": {
                  "type": "long"
                },
                "probeproto": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "process": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "processtime": {
                  "type": "long"
                },
                "profile": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "profile_vd": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "profilegroup": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "profiletype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "qtypeval": {
                  "type": "long"
                },
                "quarskip": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "quotaexceeded": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "quotamax": {
                  "type": "long"
                },
                "quotatype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "quotaused": {
                  "type": "long"
                },
                "radioband": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "radioid": {
                  "type": "long"
                },
                "radioidclosest": {
                  "type": "long"
                },
                "radioiddetected": {
                  "type": "long"
                },
                "rate": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "rawdata": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "rawdataid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "rcvddelta": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reason": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "received": {
                  "type": "long"
                },
                "receivedsignature": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "red": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "referralurl": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "remote": {
                  "type": "ip"
                },
                "remotewtptime": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reporttype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reqtype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "request_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "result": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "role": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "rssi": {
                  "type": "long"
                },
                "rsso_key": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ruledata": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ruletype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "scanned": {
                  "type": "long"
                },
                "scantime": {
                  "type": "long"
                },
                "scope": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "security": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sensitivity": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sensor": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sentdelta": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "seq": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "serial": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "serialno": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "server": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "session_id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sessionid": {
                  "type": "long"
                },
                "setuprate": {
                  "type": "long"
                },
                "severity": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "shaperdroprcvdbyte": {
                  "type": "long"
                },
                "shaperdropsentbyte": {
                  "type": "long"
                },
                "shaperperipdropbyte": {
                  "type": "long"
                },
                "shaperperipname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "shaperrcvdname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "shapersentname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "shapingpolicyid": {
                  "type": "long"
                },
                "signal": {
                  "type": "long"
                },
                "size": {
                  "type": "long"
                },
                "slot": {
                  "type": "long"
                },
                "sn": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "snclosest": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sndetected": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "snmeshparent": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "spi": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "src_int": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srccountry": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srcfamily": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srchwvendor": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srchwversion": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srcinetsvc": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srcintfrole": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srcname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srcserver": {
                  "type": "long"
                },
                "srcssid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srcswversion": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "srcuuid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sscname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ssid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sslaction": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ssllocal": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sslremote": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "stacount": {
                  "type": "long"
                },
                "stage": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "stamac": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "state": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "status": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "stitch": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "subject": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "submodule": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "subservice": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "subtype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "suspicious": {
                  "type": "long"
                },
                "switchproto": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sync_status": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sync_type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "sysuptime": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "tamac": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "threattype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "time": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "to": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "to_vcluster": {
                  "type": "long"
                },
                "total": {
                  "type": "long"
                },
                "totalsession": {
                  "type": "long"
                },
                "trace_id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "trandisp": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "transid": {
                  "type": "long"
                },
                "translationid": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "trigger": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "trueclntip": {
                  "type": "ip"
                },
                "tunnelid": {
                  "type": "long"
                },
                "tunnelip": {
                  "type": "ip"
                },
                "tunneltype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ui": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "unauthusersource": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "unit": {
                  "type": "long"
                },
                "urlfilteridx": {
                  "type": "long"
                },
                "urlfilterlist": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "urlsource": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "urltype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "used": {
                  "type": "long"
                },
                "used_for_type": {
                  "type": "long"
                },
                "utmaction": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "utmref": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vap": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vapmode": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vcluster": {
                  "type": "long"
                },
                "vcluster_member": {
                  "type": "long"
                },
                "vcluster_state": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vd": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vdname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vendorurl": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "version": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vip": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "virus": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "virusid": {
                  "type": "long"
                },
                "voip_proto": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vpn": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vpntunnel": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vpntype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vrf": {
                  "type": "long"
                },
                "vulncat": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vulnid": {
                  "type": "long"
                },
                "vulnname": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vwlid": {
                  "type": "long"
                },
                "vwlquality": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vwlservice": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vwpvlanid": {
                  "type": "long"
                },
                "wanin": {
                  "type": "long"
                },
                "wanoptapptype": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "wanout": {
                  "type": "long"
                },
                "weakwepiv": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "xauthgroup": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "xauthuser": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "xid": {
                  "type": "long"
                }
              }
            }
          }
        }
      }
    }
  }
}