Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Elasticsearch index template for logstash that contains additional NGINX fields
{
"template_logstash":{
"template" : "logstash*",
"settings" : {
"number_of_shards" : 5,
"index.cache.field.type" : "soft",
"index.refresh_interval" : "5s",
"index.store.compress.stored" : true,
"index.query.default_field" : "message",
"index.routing.allocation.total_shards_per_node" : 5
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : false},
"properties" : {
"message": { "type": "string", "index": "analyzed" },
"@source": { "type": "string", "index": "no" },
"@source_host": { "type": "string", "index": "not_analyzed" },
"@source_path": { "type": "string", "index": "not_analyzed" },
"@tags": { "type": "string", "index": "not_analyzed" },
"@timestamp": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ss.SSSZZ||yyyy-MM-dd'T'HH:mm:ssZZ", "index": "not_analyzed" },
"@type": { "type": "string", "index": "not_analyzed" },
"@fields": {
"type" : "object",
"path" : "full",
"properties" : {
"bytes": { "index_name": "bytes", "type": "integer", "ignore_malformed": true, "index": "not_analyzed" },
"clientip": { "index_name": "clientip", "type": "ip", "index": "not_analyzed" },
"host": { "index_name": "host", "type": "string", "index": "analyzed" },
"httpversion": { "index_name": "httpversion", "type": "float", "ignore_malformed": true, "index": "not_analyzed" },
"method": { "index_name": "method", "type": "string", "index": "not_analyzed" },
"path": { "index_name": "path", "type": "string", "index": "analyzed" },
"referrer": { "index_name": "referrer", "type": "string", "index": "not_analyzed" },
"response": { "index_name": "response", "type": "integer", "ignore_malformed": true, "index": "not_analyzed" },
"syslog_hostname": { "index_name": "syslog_hostname", "type": "string", "index": "not_analyzed" },
"syslog_pri": { "index_name": "syslog_pri", "type": "integer", "ignore_malformed": true, "index": "not_analyzed" },
"syslog_program": { "index_name": "syslog_program", "type": "string", "index": "not_analyzed" },
"syslog_timestamp": { "index_name": "syslog_timestamp", "type": "string", "index": "no" },
"time": { "index_name": "time", "type": "string", "index": "no" },
"upstr_ip": { "index_name": "upstr_ip", "type": "ip", "index": "not_analyzed" },
"upstr_port": { "index_name": "upstr_port", "type": "integer", "ignore_malformed": true, "index": "not_analyzed" },
"upstrcode": { "index_name": "upstrcode", "type": "integer", "ignore_malformed": true, "index": "not_analyzed" },
"upstrtime": { "index_name": "upstrtime", "type": "float", "ignore_malformed": true, "index": "not_analyzed" },
"useragent": { "index_name": "useragent", "type": "string", "index": "analyzed" }
}
}
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.