mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
323 lines
9.8 KiB
JSON
323 lines
9.8 KiB
JSON
{"template": {
|
|
"settings": {
|
|
"index": {
|
|
"lifecycle": {
|
|
"name": "logs"
|
|
},
|
|
"codec": "best_compression",
|
|
"default_pipeline": "logs-elastic_agent.packetbeat-1.7.0",
|
|
"mapping": {
|
|
"total_fields": {
|
|
"limit": "10000"
|
|
}
|
|
},
|
|
"query": {
|
|
"default_field": [
|
|
"cloud.account.id",
|
|
"cloud.availability_zone",
|
|
"cloud.instance.id",
|
|
"cloud.instance.name",
|
|
"cloud.machine.type",
|
|
"cloud.provider",
|
|
"cloud.region",
|
|
"cloud.project.id",
|
|
"cloud.image.id",
|
|
"container.id",
|
|
"container.image.name",
|
|
"container.name",
|
|
"host.architecture",
|
|
"host.hostname",
|
|
"host.id",
|
|
"host.mac",
|
|
"host.name",
|
|
"host.os.family",
|
|
"host.os.kernel",
|
|
"host.os.name",
|
|
"host.os.platform",
|
|
"host.os.version",
|
|
"host.os.build",
|
|
"host.os.codename",
|
|
"host.type",
|
|
"ecs.version",
|
|
"agent.build.original",
|
|
"agent.ephemeral_id",
|
|
"agent.id",
|
|
"agent.name",
|
|
"agent.type",
|
|
"agent.version",
|
|
"log.level",
|
|
"message",
|
|
"elastic_agent.id",
|
|
"elastic_agent.process",
|
|
"elastic_agent.version"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"mappings": {
|
|
"dynamic": false,
|
|
"dynamic_templates": [
|
|
{
|
|
"container.labels": {
|
|
"path_match": "container.labels.*",
|
|
"mapping": {
|
|
"type": "keyword"
|
|
},
|
|
"match_mapping_type": "string"
|
|
}
|
|
}
|
|
],
|
|
"properties": {
|
|
"cloud": {
|
|
"properties": {
|
|
"availability_zone": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"image": {
|
|
"properties": {
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"instance": {
|
|
"properties": {
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"provider": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"machine": {
|
|
"properties": {
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"project": {
|
|
"properties": {
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"region": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"account": {
|
|
"properties": {
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"container": {
|
|
"properties": {
|
|
"image": {
|
|
"properties": {
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"agent": {
|
|
"properties": {
|
|
"build": {
|
|
"properties": {
|
|
"original": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ephemeral_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"@timestamp": {
|
|
"type": "date"
|
|
},
|
|
"ecs": {
|
|
"properties": {
|
|
"version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"log": {
|
|
"properties": {
|
|
"level": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"data_stream": {
|
|
"properties": {
|
|
"namespace": {
|
|
"type": "constant_keyword"
|
|
},
|
|
"type": {
|
|
"type": "constant_keyword"
|
|
},
|
|
"dataset": {
|
|
"type": "constant_keyword"
|
|
}
|
|
}
|
|
},
|
|
"host": {
|
|
"properties": {
|
|
"hostname": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"os": {
|
|
"properties": {
|
|
"build": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"kernel": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"codename": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "text"
|
|
}
|
|
}
|
|
},
|
|
"family": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"platform": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ip": {
|
|
"type": "ip"
|
|
},
|
|
"containerized": {
|
|
"type": "boolean"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"mac": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"architecture": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"elastic_agent": {
|
|
"properties": {
|
|
"process": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"snapshot": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"message": {
|
|
"type": "text"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"_meta": {
|
|
"package": {
|
|
"name": "elastic_agent"
|
|
},
|
|
"managed_by": "fleet",
|
|
"managed": true
|
|
}
|
|
}
|