securityonion/salt/elasticsearch/templates/component/so-logs-settings.json

{
        "template": {
          "settings": {
            "index": {
              "lifecycle": {
                "name": "logs"
              },
              "codec": "best_compression",
              "query": {
                "default_field": [
                  "message"
                ]
              }
            }
          }
        },
        "version": 2,
        "_meta": {
          "managed": true,
          "description": "default settings for the logs index template installed by x-pack"
        }
      }