{"template": {
    "mappings": {
      "properties": {
        "pack_name": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "metadata": {
          "type": "object",
          "enabled": false
        },
        "data": {
          "properties": {
            "query": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "pack_id": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "input_type": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "pack_prebuilt": {
          "type": "boolean"
        },
        "type": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "queries": {
          "properties": {
            "action_id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "saved_query_id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "saved_query_prebuilt": {
              "type": "boolean"
            },
            "query": {
              "type": "text"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "ecs_mapping": {
              "type": "object",
              "enabled": false
            },
            "platform": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "agents": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "agents": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "@timestamp": {
          "type": "date"
        },
        "action_id": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "user_id": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "expiration": {
          "type": "date"
        },
        "event": {
          "properties": {
            "agent_id_status": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "ingested": {
              "format": "strict_date_time_no_millis||strict_date_optional_time||epoch_millis",
              "type": "date"
            }
          }
        },
        "agent_ids": {
          "ignore_above": 1024,
          "type": "keyword"
        }
      }
    }
  }
}