elasticsearch_template.sh

#!/bin/sh

curl -XPUT "http://localhost:9200/_template/rsyslog_per_index?pretty=true" -d '
{
    "template" : "rsyslog*",
    "settings" : {
        "number_of_shards" : 4,
        "index.cache.field.type" : "soft",
        "index.refresh_interval" : "5s",
        "index.store.compress.stored" : true,
        "index.query.default_field" : "@msg",
        "index.routing.allocation.total_shards_per_node" : 4
    },
    "mappings" : {
        "_default_" : {
            "_all" : { "enabled" : false },
            "properties" : {
               "@msg":           { "type": "string", "index": "analyzed" },
               "@host":          { "type": "string", "index": "not_analyzed" },
               "@timestamp":     { "type": "date",   "index": "not_analyzed" },
               "@fromip":        { "type": "ip" },
               "@tag":           { "type": "string", "index": "not_analyzed" },
               "@pri":           { "type": "integer" },
               "@pri-text":      { "type": "string", "index": "not_analyzed" },
               "@facility":      { "type": "integer" },
               "@facility-text": { "type": "string", "index": "not_analyzed" },
               "@severity":      { "type": "integer" },
               "@severity-text": { "type": "string", "index": "not_analyzed" },
               "@app":           { "type": "string", "index": "not_analyzed" },
               "@pid":           { "type": "string", "index": "not_analyzed" }
             }
        }
    }
}
'