Create a gist now

Instantly share code, notes, and snippets.

What would you like to do?
{
"template": "elb_access_log*",
"mappings" : {
"elb_access_log" : {
"properties" : {
"backend" : {
"type" : "ip"
},
"backend_port" : {
"type" : "integer",
"index" : "not_analyzed"
},
"backend_processing_time" : {
"type" : "double"
},
"backend_status_code" : {
"type" : "integer",
"index" : "not_analyzed"
},
"client" : {
"type" : "ip"
},
"client_port" : {
"type" : "integer"
},
"elb" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"elb_status_code" : {
"type" : "integer"
},
"received_bytes" : {
"type" : "integer"
},
"request" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"request_http_version" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"request_method" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"request_processing_time" : {
"type" : "double"
},
"request_uri" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"request_uri_host" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"request_uri_path" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"request_uri_port" : {
"type" : "integer",
"index" : "not_analyzed"
},
"request_uri_query" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"request_uri_scheme" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"response_processing_time" : {
"type" : "double"
},
"sent_bytes" : {
"type" : "integer"
},
"ssl_cipher" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ssl_protocol" : {
"type" : "text",
"index" : "not_analyzed",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"@timestamp" : {
"type" : "date"
},
"user_agent" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment