logstash-template.json

{
    "template": "sfly-preprod-logs-*",
    "settings" : {
        "number_of_shards" : 5,
        "number_of_replicas" : 1,
        "index" : {
            "query" : { "default_field" : "@message" },
            "store" : { "compress" : { "stored" : true, "tv": true } }
        }
    },
    "mappings": {
        "_default_": { 
            "_all": { "enabled": false },
            "_source": { "excludes": ["@signature"] },
            "_ttl": { "enabled": true, "default": "4w" },
            "dynamic_templates": [
                {
                    "string_template" : { 
                        "match" : "*",
                        "mapping": { "type": "string", "index": "not_analyzed" },
                        "match_mapping_type" : "string"
                     } 
                 }
             ],
             "properties" : {
                "@fields" : {
                   "type" : "object",
                   "dynamic": true,
                   "path": "full",
                   "properties" : {
                       "clientip" : { "type": "ip"}
                   }
                },
                "@message" : { "type" : "string", "index" : "analyzed" },
                "@source" : { "type" : "string", "index" : "not_analyzed" },
                "@source_host" : { "type" : "string", "index" : "not_analyzed" },
                "@source_path" : { "type" : "string", "index" : "not_analyzed" },
                "@tags": { "type": "string", "index" : "not_analyzed" }, 
                "@timestamp" : { "type" : "date", "index" : "not_analyzed" },
                "@type" : { "type" : "string", "index" : "not_analyzed" },
                "@signature": { "type" : "string", "index" : "not_analyzed" },
                "@checksum" : {"type" : "string", "index" : "not_analyzed" }
            }
        }
    }
}

set-template.sh

curl -XPUT 'http://localhost:9200/_template/template_logstash/' -d @logstash-template.json