securityonion/salt/elasticsearch/templates/component/elastic-agent/logs-cisco_duo.admin@custom.json

{
  "template": {
    "mappings": {
      "properties": {
        "host": {
	  "properties":{
            "ip": {
              "type": "ip"
            }
	  }
	},
	"related": {
          "properties":{
            "ip": {
              "type": "ip"
            }
          }
        },
	"destination": {
          "properties":{
            "ip": {
              "type": "ip"
            }
          }
        },
	"source": {
          "properties":{
            "ip": {
              "type": "ip"
            }
          }
        }
      }
    }
  }
}