mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-15 21:52:47 +01:00
66 lines
1.5 KiB
JSON
66 lines
1.5 KiB
JSON
{
|
|
"_meta": {
|
|
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-data_stream.html",
|
|
"ecs_version": "1.12.2"
|
|
},
|
|
"template": {
|
|
"settings": {
|
|
"analysis": {
|
|
"analyzer": {
|
|
"es_security_analyzer": {
|
|
"type": "custom",
|
|
"char_filter": [
|
|
"whitespace_no_way"
|
|
],
|
|
"filter": [
|
|
"lowercase",
|
|
"trim"
|
|
],
|
|
"tokenizer": "keyword"
|
|
}
|
|
},
|
|
"char_filter": {
|
|
"whitespace_no_way": {
|
|
"type": "pattern_replace",
|
|
"pattern": "(\\s)+",
|
|
"replacement": "$1"
|
|
}
|
|
},
|
|
"filter": {
|
|
"path_hierarchy_pattern_filter": {
|
|
"type": "pattern_capture",
|
|
"preserve_original": true,
|
|
"patterns": [
|
|
"((?:[^\\\\]*\\\\)*)(.*)",
|
|
"((?:[^/]*/)*)(.*)"
|
|
]
|
|
}
|
|
},
|
|
"tokenizer": {
|
|
"path_tokenizer": {
|
|
"type": "path_hierarchy",
|
|
"delimiter": "\\"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mappings": {
|
|
"properties": {
|
|
"data_stream": {
|
|
"properties": {
|
|
"dataset": {
|
|
"type": "constant_keyword"
|
|
},
|
|
"namespace": {
|
|
"type": "constant_keyword"
|
|
},
|
|
"type": {
|
|
"type": "constant_keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|