logstash elasticsearch template - disable _all field, enable simple analyzer, set default query field to @message

curl

curl -XPUT localhost:9200/_template/logstash -d '
{
  "template" : "logs-*",
  "settings" : {
  	"index.analysis.analyzer.default.type": "simple",
	"index.cache.field.type": "soft",
    "index.compress.stored": true,
    "index.merge.policy.max_merged_segment": "5g",
    "index.query.default_field": "@message",
    "index.refresh_interval": "5s",
    "index.term_index_divisor": 1,
    "index.term_index_interval": 128,
    "number_of_replicas": 1,
    "number_of_shards": 3
  },
    "mappings": {
        "_default_": {
            "_all": {
                "enabled": false
            },
            "properties": {
                "@message": {
                    "type": "string",
                    "index": "analyzed"
                },
                "@source": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "@source_host": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "@source_path": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "@tags": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "@timestamp": {
                    "type": "date",
                    "index": "not_analyzed"
                },
                "@type": {
                    "type": "string",
                    "index": "not_analyzed"
                }
            }
        }
    }
}'