{
  "index_patterns": [
    "ecs-1.11.0-8-*",
    "ecs-*-1.11.0-8-*"
  ],
  "mappings": {
    "_doc": {
      "_meta": {
        "version": "1.11.0-8"
      },
      "date_detection": false,
      "dynamic_templates": [
        {
          "strings_as_keyword": {
            "mapping": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "match_mapping_type": "string"
          }
        },
        {
          "metrics_puppet_runtime_seconds_half_float": {
            "mapping": {
              "type": "half_float"
            },
            "path_match": "metrics.puppet.runtime.*.seconds"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "client": {
          "properties": {
            "address": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "as": {
              "properties": {
                "number": {
                  "type": "long"
                },
                "organization": {
                  "properties": {
                    "name": {
                      "fields": {
                        "text": {
                          "norms": false,
                          "type": "text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "bytes": {
              "type": "long"
            },
            "domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "geo": {
              "properties": {
                "city_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "location": {
                  "type": "geo_point"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "postal_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "timezone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "ip": {
              "type": "ip"
            },
            "mac": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "nat": {
              "properties": {
                "ip": {
                  "type": "ip"
                },
                "port": {
                  "type": "long"
                }
              }
            },
            "packets": {
              "type": "long"
            },
            "port": {
              "type": "long"
            },
            "registered_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "subdomain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "top_level_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "user": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "extra": {
                  "enabled": false,
                  "type": "object"
                },
                "full_name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "group": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "roles": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        },
        "container": {
          "properties": {
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "image": {
              "properties": {
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "tag": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "labels": {
              "type": "object"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "runtime": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "destination": {
          "properties": {
            "address": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "as": {
              "properties": {
                "number": {
                  "type": "long"
                },
                "organization": {
                  "properties": {
                    "name": {
                      "fields": {
                        "text": {
                          "norms": false,
                          "type": "text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "bytes": {
              "type": "long"
            },
            "domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "geo": {
              "properties": {
                "city_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "location": {
                  "type": "geo_point"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "postal_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "timezone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "ip": {
              "type": "ip"
            },
            "mac": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "nat": {
              "properties": {
                "ip": {
                  "type": "ip"
                },
                "port": {
                  "type": "long"
                }
              }
            },
            "packets": {
              "type": "long"
            },
            "port": {
              "type": "long"
            },
            "registered_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "subdomain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "top_level_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "user": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "extra": {
                  "enabled": false,
                  "type": "object"
                },
                "full_name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "group": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "roles": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        },
        "ecs": {
          "properties": {
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "error": {
          "properties": {
            "code": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "message": {
              "norms": false,
              "type": "text"
            },
            "stack": {
              "properties": {
                "head": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "previous_trace": {
                  "doc_values": false,
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "index": false,
                  "type": "keyword"
                }
              }
            },
            "stack_trace": {
              "doc_values": false,
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "index": false,
              "type": "keyword"
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "event": {
          "properties": {
            "action": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "agent_id_status": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "category": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "code": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "created": {
              "type": "date"
            },
            "dataset": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "duration": {
              "type": "long"
            },
            "end": {
              "type": "date"
            },
            "hash": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "ingested": {
              "type": "date"
            },
            "kind": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "module": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "original": {
              "doc_values": false,
              "index": false,
              "type": "keyword"
            },
            "outcome": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "provider": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "reason": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "reference": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "risk_score": {
              "type": "float"
            },
            "risk_score_norm": {
              "type": "float"
            },
            "sequence": {
              "type": "long"
            },
            "severity": {
              "type": "long"
            },
            "start": {
              "type": "date"
            },
            "timezone": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "url": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "git": {
          "properties": {
            "commit": {
              "properties": {
                "author": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "hash": {
                  "properties": {
                    "sha1": {
                      "properties": {
                        "full": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "short": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    }
                  }
                }
              }
            },
            "repo": {
              "properties": {
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "url": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "full": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "original": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "scheme": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            }
          }
        },
        "host": {
          "properties": {
            "architecture": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "cpu": {
              "properties": {
                "usage": {
                  "scaling_factor": 1000,
                  "type": "scaled_float"
                }
              }
            },
            "disk": {
              "properties": {
                "read": {
                  "properties": {
                    "bytes": {
                      "type": "long"
                    }
                  }
                },
                "write": {
                  "properties": {
                    "bytes": {
                      "type": "long"
                    }
                  }
                }
              }
            },
            "domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "geo": {
              "properties": {
                "city_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "location": {
                  "type": "geo_point"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "postal_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "timezone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "hostname": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "ip": {
              "type": "ip"
            },
            "mac": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "network": {
              "properties": {
                "egress": {
                  "properties": {
                    "bytes": {
                      "type": "long"
                    },
                    "packets": {
                      "type": "long"
                    }
                  }
                },
                "ingress": {
                  "properties": {
                    "bytes": {
                      "type": "long"
                    },
                    "packets": {
                      "type": "long"
                    }
                  }
                }
              }
            },
            "os": {
              "properties": {
                "family": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "full": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "kernel": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "platform": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "version": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "uptime": {
              "type": "long"
            },
            "user": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "extra": {
                  "enabled": false,
                  "type": "object"
                },
                "full_name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "group": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "roles": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        },
        "http": {
          "properties": {
            "request": {
              "properties": {
                "body": {
                  "properties": {
                    "bytes": {
                      "type": "long"
                    },
                    "content": {
                      "fields": {
                        "text": {
                          "norms": false,
                          "type": "text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "bytes": {
                  "type": "long"
                },
                "headers": {
                  "type": "object"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "method": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "mime_type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "referrer": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "response": {
              "properties": {
                "body": {
                  "properties": {
                    "bytes": {
                      "type": "long"
                    },
                    "content": {
                      "fields": {
                        "text": {
                          "norms": false,
                          "type": "text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "bytes": {
                  "type": "long"
                },
                "headers": {
                  "type": "object"
                },
                "mime_type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "status_code": {
                  "type": "long"
                }
              }
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "labels": {
          "type": "object"
        },
        "log": {
          "properties": {
            "file": {
              "properties": {
                "path": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "level": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "logger": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "origin": {
              "properties": {
                "file": {
                  "properties": {
                    "line": {
                      "type": "integer"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "function": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "original": {
              "doc_values": false,
              "index": false,
              "type": "keyword"
            },
            "syslog": {
              "properties": {
                "facility": {
                  "properties": {
                    "code": {
                      "type": "long"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "priority": {
                  "type": "long"
                },
                "severity": {
                  "properties": {
                    "code": {
                      "type": "long"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              },
              "type": "object"
            }
          }
        },
        "message": {
          "norms": false,
          "type": "text"
        },
        "metrics": {
          "properties": {
            "puppet": {
              "properties": {
                "changes": {
                  "properties": {
                    "total": {
                      "type": "long"
                    }
                  }
                },
                "resources": {
                  "properties": {
                    "changed": {
                      "properties": {
                        "total": {
                          "type": "long"
                        }
                      }
                    },
                    "corrective_change": {
                      "properties": {
                        "total": {
                          "type": "long"
                        }
                      }
                    },
                    "failed": {
                      "properties": {
                        "total": {
                          "type": "long"
                        }
                      }
                    },
                    "failed_to_restart": {
                      "properties": {
                        "total": {
                          "type": "long"
                        }
                      }
                    },
                    "out_of_sync": {
                      "properties": {
                        "total": {
                          "type": "long"
                        }
                      }
                    },
                    "restarted": {
                      "properties": {
                        "total": {
                          "type": "long"
                        }
                      }
                    },
                    "scheduled": {
                      "properties": {
                        "total": {
                          "type": "long"
                        }
                      }
                    },
                    "skipped": {
                      "properties": {
                        "total": {
                          "type": "long"
                        }
                      }
                    },
                    "total": {
                      "type": "long"
                    }
                  }
                },
                "runtime": {
                  "type": "object"
                }
              }
            },
            "ttfb": {
              "properties": {
                "seconds": {
                  "type": "half_float"
                }
              }
            }
          }
        },
        "network": {
          "properties": {
            "application": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "bytes": {
              "type": "long"
            },
            "community_id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "direction": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "forwarded_ip": {
              "type": "ip"
            },
            "iana_number": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "inner": {
              "properties": {
                "vlan": {
                  "properties": {
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              },
              "type": "object"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "packets": {
              "type": "long"
            },
            "protocol": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "tcp_flags": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "transport": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "vlan": {
              "properties": {
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        },
        "normalized": {
          "properties": {
            "dropped": {
              "properties": {
                "field_type_mismatch": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "no_such_field": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "unknown_data_type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "message": {
              "ignore_above": 256,
              "type": "keyword"
            }
          }
        },
        "observer": {
          "properties": {
            "egress": {
              "properties": {
                "interface": {
                  "properties": {
                    "alias": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "vlan": {
                  "properties": {
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "zone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              },
              "type": "object"
            },
            "geo": {
              "properties": {
                "city_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "location": {
                  "type": "geo_point"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "postal_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "timezone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "hostname": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "ingress": {
              "properties": {
                "interface": {
                  "properties": {
                    "alias": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "vlan": {
                  "properties": {
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "zone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              },
              "type": "object"
            },
            "ip": {
              "type": "ip"
            },
            "mac": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "os": {
              "properties": {
                "family": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "full": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "kernel": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "platform": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "version": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "product": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "serial_number": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "vendor": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "orchestrator": {
          "properties": {
            "api_version": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "cluster": {
              "properties": {
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "url": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "version": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "namespace": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "organization": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "resource": {
              "properties": {
                "annotation": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "label": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "package": {
          "properties": {
            "architecture": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "build_version": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "checksum": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "description": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "install_scope": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "installed": {
              "type": "date"
            },
            "license": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "path": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "reference": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "size": {
              "type": "long"
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "process": {
          "properties": {
            "args": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "args_count": {
              "type": "long"
            },
            "command_line": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "entity_id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "executable": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "exit_code": {
              "type": "long"
            },
            "name": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "pgid": {
              "type": "long"
            },
            "pid": {
              "type": "long"
            },
            "ppid": {
              "type": "long"
            },
            "start": {
              "type": "date"
            },
            "thread": {
              "properties": {
                "id": {
                  "type": "long"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "title": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "uptime": {
              "type": "long"
            },
            "working_directory": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "query": {
          "properties": {
            "span": {
              "properties": {
                "end": {
                  "type": "date"
                },
                "start": {
                  "type": "date"
                },
                "total": {
                  "type": "float"
                }
              }
            },
            "text": {
              "doc_values": false,
              "index": false,
              "type": "keyword"
            }
          }
        },
        "rule": {
          "properties": {
            "author": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "category": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "description": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "license": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "reference": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "ruleset": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "uuid": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "server": {
          "properties": {
            "address": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "as": {
              "properties": {
                "number": {
                  "type": "long"
                },
                "organization": {
                  "properties": {
                    "name": {
                      "fields": {
                        "text": {
                          "norms": false,
                          "type": "text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "bytes": {
              "type": "long"
            },
            "domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "geo": {
              "properties": {
                "city_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "location": {
                  "type": "geo_point"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "postal_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "timezone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "ip": {
              "type": "ip"
            },
            "mac": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "nat": {
              "properties": {
                "ip": {
                  "type": "ip"
                },
                "port": {
                  "type": "long"
                }
              }
            },
            "packets": {
              "type": "long"
            },
            "port": {
              "type": "long"
            },
            "registered_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "subdomain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "top_level_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "user": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "extra": {
                  "enabled": false,
                  "type": "object"
                },
                "full_name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "group": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "roles": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        },
        "service": {
          "properties": {
            "ephemeral_id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "node": {
              "properties": {
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "state": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "source": {
          "properties": {
            "address": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "as": {
              "properties": {
                "number": {
                  "type": "long"
                },
                "organization": {
                  "properties": {
                    "name": {
                      "fields": {
                        "text": {
                          "norms": false,
                          "type": "text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "bytes": {
              "type": "long"
            },
            "domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "geo": {
              "properties": {
                "city_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "continent_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "country_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "location": {
                  "type": "geo_point"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "postal_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_iso_code": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "region_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "timezone": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "ip": {
              "type": "ip"
            },
            "mac": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "nat": {
              "properties": {
                "ip": {
                  "type": "ip"
                },
                "port": {
                  "type": "long"
                }
              }
            },
            "packets": {
              "type": "long"
            },
            "port": {
              "type": "long"
            },
            "registered_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "subdomain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "top_level_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "user": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "extra": {
                  "enabled": false,
                  "type": "object"
                },
                "full_name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "group": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "roles": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        },
        "span": {
          "properties": {
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "tags": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "tls": {
          "properties": {
            "cipher": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "client": {
              "properties": {
                "certificate": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "certificate_chain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "hash": {
                  "properties": {
                    "md5": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "sha1": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "sha256": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "issuer": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ja3": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "not_after": {
                  "type": "date"
                },
                "not_before": {
                  "type": "date"
                },
                "server_name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "subject": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "supported_ciphers": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "x509": {
                  "properties": {
                    "alternative_names": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "issuer": {
                      "properties": {
                        "common_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "country": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "distinguished_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "locality": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organization": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organizational_unit": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "state_or_province": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "not_after": {
                      "type": "date"
                    },
                    "not_before": {
                      "type": "date"
                    },
                    "public_key_algorithm": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "public_key_curve": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "public_key_exponent": {
                      "doc_values": false,
                      "index": false,
                      "type": "long"
                    },
                    "public_key_size": {
                      "type": "long"
                    },
                    "serial_number": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "signature_algorithm": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "subject": {
                      "properties": {
                        "common_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "country": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "distinguished_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "locality": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organization": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organizational_unit": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "state_or_province": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "version_number": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "curve": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "established": {
              "type": "boolean"
            },
            "next_protocol": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "resumed": {
              "type": "boolean"
            },
            "server": {
              "properties": {
                "certificate": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "certificate_chain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "hash": {
                  "properties": {
                    "md5": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "sha1": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "sha256": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "issuer": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "ja3s": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "not_after": {
                  "type": "date"
                },
                "not_before": {
                  "type": "date"
                },
                "subject": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "x509": {
                  "properties": {
                    "alternative_names": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "issuer": {
                      "properties": {
                        "common_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "country": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "distinguished_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "locality": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organization": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organizational_unit": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "state_or_province": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "not_after": {
                      "type": "date"
                    },
                    "not_before": {
                      "type": "date"
                    },
                    "public_key_algorithm": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "public_key_curve": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "public_key_exponent": {
                      "doc_values": false,
                      "index": false,
                      "type": "long"
                    },
                    "public_key_size": {
                      "type": "long"
                    },
                    "serial_number": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "signature_algorithm": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "subject": {
                      "properties": {
                        "common_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "country": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "distinguished_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "locality": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organization": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organizational_unit": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "state_or_province": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "version_number": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "version_protocol": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "trace": {
          "properties": {
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "transaction": {
          "properties": {
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "url": {
          "properties": {
            "domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "extension": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "fragment": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "full": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "original": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "password": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "path": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "port": {
              "type": "long"
            },
            "query": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "registered_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "scheme": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "subdomain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "top_level_domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "username": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "user": {
          "properties": {
            "changes": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "extra": {
                  "enabled": false,
                  "type": "object"
                },
                "full_name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "group": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "roles": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "domain": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "effective": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "extra": {
                  "enabled": false,
                  "type": "object"
                },
                "full_name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "group": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "roles": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "email": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "extra": {
              "enabled": false,
              "type": "object"
            },
            "full_name": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "group": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "hash": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "roles": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "target": {
              "properties": {
                "domain": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "extra": {
                  "enabled": false,
                  "type": "object"
                },
                "full_name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "group": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "hash": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "roles": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        },
        "user_agent": {
          "properties": {
            "device": {
              "properties": {
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "original": {
              "fields": {
                "text": {
                  "norms": false,
                  "type": "text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "os": {
              "properties": {
                "family": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "full": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "kernel": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "norms": false,
                      "type": "text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "platform": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "version": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        }
      }
    }
  },
  "order": 1,
  "settings": {
    "analysis": {
      "analyzer": {
        "default": {
          "stopwords": "_none_",
          "type": "standard"
        }
      }
    },
    "index": {
      "mapping": {
        "total_fields": {
          "limit": 2048
        }
      },
      "query": {
        "default_field": "message"
      },
      "refresh_interval": "5s",
      "routing": {
        "allocation": {
          "require": {
            "disktype": "ssd"
          }
        }
      }
    },
    "number_of_replicas": 2,
    "number_of_shards": 1
  }
}