example-index-template.json

{
  "template": "sensor1_index*",
  "mappings": {
    "sensor1_doc": {
      "_timestamp": {
        "enabled": true
      },
      "properties": {
        "timestamp": {
          "type": "date",
          "format": "epoch_millis"
        },
        "ip_src_addr": {
          "type": "ip"
        },
        "ip_src_port": {
          "type": "integer"
        },
        "ip_dst_addr": {
          "type": "ip"
        },
        "ip_dst_port": {
          "type": "integer"
        }
      }
    }
  }
}

This is an example index template for a new sensor called 'sensor1'.

• The template will apply to any indices that are named sensor1_index*.
• The index has one document type that must be named sensor1_doc.
• The index is expected to contain timestamps.
• The properties section defines the types of each field. I have defined the 5 common fields that most sensors contain.
• Additional fields can be added following the 5 that are already defined.