Elasticsearch Index Template for Logstash Syslog

elas_index_template-syslog.json

{
  "template" : "syslog-1-*",
  "settings" : {
    "index.refresh_interval" : "5s"
  },
  "aliases": {
    "syslog": {}
  },
  "mappings" : {
    "_default_" : {
       "_all" : {"enabled" : true, "omit_norms" : true},
       "dynamic_templates" : [ {
         "message_field" : {
           "match" : "message",
           "match_mapping_type" : "string",
           "mapping" : {
             "type" : "string", "index" : "analyzed", "omit_norms" : true
           }
         }
       }, {
         "string_fields" : {
           "match" : "*",
           "match_mapping_type" : "string",
           "mapping" : {
             "type" : "string", "index" : "analyzed", "omit_norms" : true,
               "fields" : {
                 "raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
               }
           }
         }
       } ],
       "properties" : {
         "@host":            { "type": "string",  "index": "not_analyzed" },

         "@project_environment": { "type": "string", "index": "not_analyzed" },
         "@project":         { "type": "string",  "index": "not_analyzed" },
         "@location":        { "type": "string",  "index": "not_analyzed" },
         "@location_rack":   { "type": "string",  "index": "not_analyzed" },
         "@syslog_facility": { "type": "string",  "index": "not_analyzed" },
         "@syslog_hostname": { "type": "string",  "index": "not_analyzed" },
         "@syslog_message":  { "type": "string",  "analyzer": "whitespace" },
         "@message":         { "type": "string",  "analyzer": "whitespace" },
         "@syslog_pri":      { "type": "integer", "ignore_malformed": true, "index": "not_analyzed" },
         "@syslog_program":  { "type": "string",  "index": "not_analyzed" },
         "@syslog_severity": { "type": "string",  "index": "not_analyzed" },

         "@php_error_type":  { "type": "string",  "index": "not_analyzed" },
         "@php_line":        { "type": "integer", "index": "not_analyzed" },
         "@php_path":        { "type": "string",  "index": "analyzed" },
         "@php_severity":    { "type": "string",  "index": "not_analyzed" },

         "@nf_action1":      { "type": "string",  "index": "not_analyzed" },
         "@tnf_action2":     { "type": "string",  "index": "not_analyzed" },
         "@tnf_dst_ip":      { "type": "string",  "index": "not_analyzed" },
         "@tnf_dst_mac":     { "type": "string",  "index": "not_analyzed" },
         "@tnf_dst_port":    { "type": "integer", "index": "not_analyzed" },
         "@tnf_id":          { "type": "integer", "index": "not_analyzed" },
         "@tnf_in_interface":{ "type": "string",  "index": "not_analyzed" },
         "@tnf_len":         { "type": "integer", "index": "not_analyzed" },
         "@tnf_prec":        { "type": "string",  "index": "not_analyzed" },
         "@tnf_protocol":    { "type": "string",  "index": "not_analyzed" },
         "@tnf_src_ip":      { "type": "string",  "index": "not_analyzed" },
         "@tnf_src_mac":     { "type": "string",  "index": "not_analyzed" },
         "@tnf_src_port":    { "type": "integer", "index": "not_analyzed" },
         "@tnf_tos":         { "type": "string",  "index": "not_analyzed" },
         "@tnf_ttl":         { "type": "integer", "index": "not_analyzed" },

         "@tags":            { "type": "string",  "index": "not_analyzed" },
         "@version":         { "type": "string",  "index": "not_analyzed" },

         "geoip"  : {
           "type" : "object",
             "dynamic": true,
             "properties" : {
               "location" : { "type" : "geo_point" }
             }
         }
       }
    }
  }
}