Timesketch index mapping https://registry.terraform.io/providers/elastic/elasticstack/latest/docs/resources/elasticsearch_index

index.tf

mappings = jsonencode({
	properties = {
		__ts_timeline_id = { type = "long" }
		datetime         = { type = "date" }
		timestamp        = { type = "long" }
		timestamp_desc   = { type = "text", fields = { keyword = { type = "keyword" } } }
		message          = { type = "text" }
		data_type        = { type = "text", fields = { keyword = { type = "keyword" } } }
		timesketch_label = {
			type = "nested"
			properties = {
				name = {
					type   = "text",
					fields = { keyword = { type = "keyword", "ignore_above" : 256 } }
				},
				sketch_id = { type = "long" },
				user_id   = { type = "long" },
			}
		}
	}

	# Other fields are dynamically mapped to text, this could also be mapped dynamically based on the value of the field.
	# This is not a preffered method, but it allows a single fields to be used by all different value types
	dynamic_templates = [
		{
			text = {
				match_mapping_type = "*"
				mapping = {
					type   = "text",
					fields = { keyword = { type = "keyword", "ignore_above" = 256 } }
				}
			}
		}
	]
})