Created
April 29, 2021 07:26
-
-
Save ankitdevnalkar/6d884eed329ccf2b0e036047b9d55e9e to your computer and use it in GitHub Desktop.
azure-index-mapping
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| PUT _template/cloud-audit-azure | |
| { | |
| "index_patterns": "cloud-audit-azure*", | |
| "version" : 50001, | |
| "settings" : { | |
| "index.refresh_interval" : "5s" | |
| }, | |
| "mappings" : { | |
| "properties" : { | |
| "@timestamp" : { | |
| "type" : "date" | |
| }, | |
| "@version" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "RoleLocation" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "agent" : { | |
| "properties" : { | |
| "ephemeral_id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "hostname" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "type" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "version" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "azure" : { | |
| "properties" : { | |
| "activitylogs" : { | |
| "properties" : { | |
| "RoleLocation" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "category" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "event_category" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "identity" : { | |
| "properties" : { | |
| "authorization" : { | |
| "properties" : { | |
| "action" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "evidence" : { | |
| "properties" : { | |
| "principal_id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "principal_type" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "role" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "role_assignment_id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "role_assignment_scope" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "role_definition_id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "scope" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "claims" : { | |
| "properties" : { | |
| "aio" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "altsecid" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "appid" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "appidacr" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "aud" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "exp" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "groups" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_microsoft_com/claims/authnclassreference" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_microsoft_com/claims/authnmethodsreferences" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_microsoft_com/identity/claims/identityprovider" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_microsoft_com/identity/claims/objectidentifier" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_microsoft_com/identity/claims/scope" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_microsoft_com/identity/claims/tenantid" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_xmlsoap_org/ws/2005/05/identity/claims/emailaddress" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_xmlsoap_org/ws/2005/05/identity/claims/givenname" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_xmlsoap_org/ws/2005/05/identity/claims/name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_xmlsoap_org/ws/2005/05/identity/claims/nameidentifier" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas_xmlsoap_org/ws/2005/05/identity/claims/surname" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "iat" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "ipaddr" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "iss" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "nbf" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "puid" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "rh" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "uti" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "ver" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "wids" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "xms_tcdt" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "claims_initiated_by_user" : { | |
| "properties" : { | |
| "fullname" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "givenname" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "schema" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "surname" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "operation_name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "properties" : { | |
| "properties" : { | |
| "entity" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "eventCategory" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "hierarchy" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "message" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "service_request_id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "status_code" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "result_signature" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "result_type" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "tenantId" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "correlation_id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "resource" : { | |
| "properties" : { | |
| "group" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "provider" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "subscription_id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "azure-eventhub" : { | |
| "properties" : { | |
| "consumer_group" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "enqueued_time" : { | |
| "type" : "date" | |
| }, | |
| "eventhub" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "offset" : { | |
| "type" : "long" | |
| }, | |
| "sequence_number" : { | |
| "type" : "long" | |
| } | |
| } | |
| }, | |
| "callerIpAddress" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "category" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "cloud" : { | |
| "properties" : { | |
| "account" : { | |
| "properties" : { | |
| "id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "availability_zone" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "image" : { | |
| "properties" : { | |
| "id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "instance" : { | |
| "properties" : { | |
| "id" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "machine" : { | |
| "properties" : { | |
| "type" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "provider" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "region" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "correlationId" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "durationMs" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "ecs" : { | |
| "properties" : { | |
| "version" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "event" : { | |
| "properties" : { | |
| "action" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "dataset" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "duration" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "kind" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "module" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "fileset" : { | |
| "properties" : { | |
| "name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "geo" : { | |
| "properties" : { | |
| "city_name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "continent_name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "country_iso_code" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "region_iso_code" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "region_name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "identity" : { | |
| "properties" : { | |
| "authorization" : { | |
| "properties" : { | |
| "action" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "evidence" : { | |
| "properties" : { | |
| "principalId" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "principalType" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "role" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "roleAssignmentId" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "roleAssignmentScope" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "roleDefinitionId" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "scope" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "claims" : { | |
| "properties" : { | |
| "aio" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "altsecid" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "appid" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "appidacr" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "aud" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "exp" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "groups" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "http://schemas" : { | |
| "properties" : { | |
| "microsoft" : { | |
| "properties" : { | |
| "com/claims/authnclassreference" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "com/claims/authnmethodsreferences" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "com/identity/claims/identityprovider" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "com/identity/claims/objectidentifier" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "com/identity/claims/scope" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "com/identity/claims/tenantid" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "xmlsoap" : { | |
| "properties" : { | |
| "org/ws/2005/05/identity/claims/emailaddress" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "org/ws/2005/05/identity/claims/givenname" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "org/ws/2005/05/identity/claims/name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "org/ws/2005/05/identity/claims/nameidentifier" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "org/ws/2005/05/identity/claims/surname" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "iat" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "ipaddr" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "iss" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "nbf" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "puid" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "rh" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "uti" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "ver" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "wids" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "xms_tcdt" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "input" : { | |
| "properties" : { | |
| "type" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "level" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "log" : { | |
| "properties" : { | |
| "level" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "operationName" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "properties" : { | |
| "properties" : { | |
| "entity" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "eventCategory" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "hierarchy" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "message" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "serviceRequestId" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "statusCode" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "resourceGroupName" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "resourceId" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "resultSignature" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "resultType" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "service" : { | |
| "properties" : { | |
| "type" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "source" : { | |
| "properties" : { | |
| "as" : { | |
| "properties" : { | |
| "number" : { | |
| "type" : "long" | |
| }, | |
| "organization" : { | |
| "properties" : { | |
| "name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "geoip": { | |
| "properties": { | |
| "city_name": { | |
| "type": "keyword" | |
| }, | |
| "continent_code": { | |
| "type": "keyword" | |
| }, | |
| "country_code2": { | |
| "type": "keyword" | |
| }, | |
| "country_code3": { | |
| "type": "keyword" | |
| }, | |
| "country_name": { | |
| "type": "keyword" | |
| }, | |
| "ip": { | |
| "type": "keyword" | |
| }, | |
| "location": { | |
| "type": "geo_point" | |
| }, | |
| "postal_code": { | |
| "type": "keyword" | |
| }, | |
| "region_code": { | |
| "type": "keyword" | |
| }, | |
| "region_name": { | |
| "type": "keyword" | |
| }, | |
| "timezone": { | |
| "type": "keyword" | |
| } | |
| } | |
| }, | |
| "ip" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "tags" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "tenantId" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "time" : { | |
| "type" : "date" | |
| }, | |
| "user" : { | |
| "properties" : { | |
| "domain" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "full_name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| }, | |
| "name" : { | |
| "type" : "text", | |
| "fields" : { | |
| "keyword" : { | |
| "type" : "keyword", | |
| "ignore_above" : 256 | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment