ElasticSearch configuration for LogStash

elasticsearch.yml

cluster:
    name:   elasticsearch

network:
    host: 127.0.0.1

path:
    logs: /var/log/elasticsearch
    data: /var/lib/elasticsearch
    conf: /etc/elasticsearch

gistfile1.txt

  * Set `path.conf` to the place where you keep your ES configuration (for example /etc/elasticsearch) 
  * `mkdir templates` in `path.conf`
  * put the json in your templates dir

logstash_per_index.json

{ 
    "template" : "logstash*",                                    
    "settings" : {
        "number_of_shards" : 1,
        "number_of_replicas" : 0,
        "index.cache.field.type" : "soft",
        "index.refresh_interval" : "5s",
        "index.store.compress.stored" : true,
        "index.store.compress.tv" : true,
        "index.query.default_field" : "@message",
        "index.routing.allocation.total_shards_per_node" : 2
    },
    "mappings" : {
        "_default_" : {
        "_all" : {"enabled" : false},
        "_source": { "compress": true },
           "properties" : {
              "@fields" : {
                   "type" : "object",
                   "dynamic": true,
                   "path": "full",
                   "properties" : {
                       "clientip" : { "type": "ip"}
                   }
              },
              "@message": { "type": "string", "index": "analyzed" },
              "@source": { "type": "string", "index": "not_analyzed" },
              "@source_host": { "type": "string", "index": "not_analyzed" },
              "@source_path": { "type": "string", "index": "not_analyzed" },
              "@tags": { "type": "string", "index": "not_analyzed" },
              "@timestamp": { "type": "date", "index": "not_analyzed" },
              "@type": { "type": "string", "index": "not_analyzed" }
           }
        }
   }
}

Damn, forgot to log in to paste this...