Skip to content

Instantly share code, notes, and snippets.

@Zawadidone
Created February 26, 2023 22:07
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Embed
What would you like to do?
mappings = jsonencode({
properties = {
__ts_timeline_id = { type = "long" }
datetime = { type = "date" }
timestamp = { type = "long" }
timestamp_desc = { type = "text", fields = { keyword = { type = "keyword" } } }
message = { type = "text" }
data_type = { type = "text", fields = { keyword = { type = "keyword" } } }
timesketch_label = {
type = "nested"
properties = {
name = {
type = "text",
fields = { keyword = { type = "keyword", "ignore_above" : 256 } }
},
sketch_id = { type = "long" },
user_id = { type = "long" },
}
}
}
# Other fields are dynamically mapped to text, this could also be mapped dynamically based on the value of the field.
# This is not a preffered method, but it allows a single fields to be used by all different value types
dynamic_templates = [
{
text = {
match_mapping_type = "*"
mapping = {
type = "text",
fields = { keyword = { type = "keyword", "ignore_above" = 256 } }
}
}
}
]
})
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment