Skip to content

Instantly share code, notes, and snippets.

@Zawadidone
Last active April 26, 2024 12:11
Show Gist options
  • Save Zawadidone/dd6e88490796d2ed11e5e0b0536246ef to your computer and use it in GitHub Desktop.
Save Zawadidone/dd6e88490796d2ed11e5e0b0536246ef to your computer and use it in GitHub Desktop.
mappings = jsonencode({
properties = {
__ts_timeline_id = { type = "long" }
datetime = { type = "date" }
timestamp_desc = { type = "text", fields = { keyword = { type = "keyword" } } }
data_type = { type = "text", fields = { keyword = { type = "keyword" } } }
timesketch_label = {
type = "nested"
properties = {
name = {
type = "text",
fields = { keyword = { type = "keyword", "ignore_above" : 256 } }
},
sketch_id = { type = "long" },
user_id = { type = "long" },
}
}
}
# Other fields are dynamically mapped to text, this could also be mapped dynamically based on the value of the field.
# This is not a preffered method, but it allows a single fields to be used by all different value types
dynamic_templates = [
{
text = {
match_mapping_type = "*"
mapping = {
type = "text",
fields = { keyword = { type = "keyword", "ignore_above" = 256 } }
}
}
}
]
})
@Zawadidone
Copy link
Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment