logstash-output-elasticsearch 11.1.0-java → 11.2.0-java

Sign up to get free protection for your applications and to get access to all the features.
@@ -0,0 +1,2948 @@
1
+ {
2
+ "index_patterns": [
3
+ "ecs-logstash-*"
4
+ ],
5
+ "mappings": {
6
+ "_meta": {
7
+ "version": "1.5.0"
8
+ },
9
+ "date_detection": false,
10
+ "dynamic_templates": [
11
+ {
12
+ "strings_as_keyword": {
13
+ "mapping": {
14
+ "ignore_above": 1024,
15
+ "type": "keyword"
16
+ },
17
+ "match_mapping_type": "string"
18
+ }
19
+ }
20
+ ],
21
+ "properties": {
22
+ "@timestamp": {
23
+ "type": "date"
24
+ },
25
+ "agent": {
26
+ "properties": {
27
+ "ephemeral_id": {
28
+ "ignore_above": 1024,
29
+ "type": "keyword"
30
+ },
31
+ "id": {
32
+ "ignore_above": 1024,
33
+ "type": "keyword"
34
+ },
35
+ "name": {
36
+ "ignore_above": 1024,
37
+ "type": "keyword"
38
+ },
39
+ "type": {
40
+ "ignore_above": 1024,
41
+ "type": "keyword"
42
+ },
43
+ "version": {
44
+ "ignore_above": 1024,
45
+ "type": "keyword"
46
+ }
47
+ }
48
+ },
49
+ "as": {
50
+ "properties": {
51
+ "number": {
52
+ "type": "long"
53
+ },
54
+ "organization": {
55
+ "properties": {
56
+ "name": {
57
+ "fields": {
58
+ "text": {
59
+ "norms": false,
60
+ "type": "text"
61
+ }
62
+ },
63
+ "ignore_above": 1024,
64
+ "type": "keyword"
65
+ }
66
+ }
67
+ }
68
+ }
69
+ },
70
+ "client": {
71
+ "properties": {
72
+ "address": {
73
+ "ignore_above": 1024,
74
+ "type": "keyword"
75
+ },
76
+ "as": {
77
+ "properties": {
78
+ "number": {
79
+ "type": "long"
80
+ },
81
+ "organization": {
82
+ "properties": {
83
+ "name": {
84
+ "fields": {
85
+ "text": {
86
+ "norms": false,
87
+ "type": "text"
88
+ }
89
+ },
90
+ "ignore_above": 1024,
91
+ "type": "keyword"
92
+ }
93
+ }
94
+ }
95
+ }
96
+ },
97
+ "bytes": {
98
+ "type": "long"
99
+ },
100
+ "domain": {
101
+ "ignore_above": 1024,
102
+ "type": "keyword"
103
+ },
104
+ "geo": {
105
+ "properties": {
106
+ "city_name": {
107
+ "ignore_above": 1024,
108
+ "type": "keyword"
109
+ },
110
+ "continent_name": {
111
+ "ignore_above": 1024,
112
+ "type": "keyword"
113
+ },
114
+ "country_iso_code": {
115
+ "ignore_above": 1024,
116
+ "type": "keyword"
117
+ },
118
+ "country_name": {
119
+ "ignore_above": 1024,
120
+ "type": "keyword"
121
+ },
122
+ "location": {
123
+ "type": "geo_point"
124
+ },
125
+ "name": {
126
+ "ignore_above": 1024,
127
+ "type": "keyword"
128
+ },
129
+ "region_iso_code": {
130
+ "ignore_above": 1024,
131
+ "type": "keyword"
132
+ },
133
+ "region_name": {
134
+ "ignore_above": 1024,
135
+ "type": "keyword"
136
+ }
137
+ }
138
+ },
139
+ "ip": {
140
+ "type": "ip"
141
+ },
142
+ "mac": {
143
+ "ignore_above": 1024,
144
+ "type": "keyword"
145
+ },
146
+ "nat": {
147
+ "properties": {
148
+ "ip": {
149
+ "type": "ip"
150
+ },
151
+ "port": {
152
+ "type": "long"
153
+ }
154
+ }
155
+ },
156
+ "packets": {
157
+ "type": "long"
158
+ },
159
+ "port": {
160
+ "type": "long"
161
+ },
162
+ "registered_domain": {
163
+ "ignore_above": 1024,
164
+ "type": "keyword"
165
+ },
166
+ "top_level_domain": {
167
+ "ignore_above": 1024,
168
+ "type": "keyword"
169
+ },
170
+ "user": {
171
+ "properties": {
172
+ "domain": {
173
+ "ignore_above": 1024,
174
+ "type": "keyword"
175
+ },
176
+ "email": {
177
+ "ignore_above": 1024,
178
+ "type": "keyword"
179
+ },
180
+ "full_name": {
181
+ "fields": {
182
+ "text": {
183
+ "norms": false,
184
+ "type": "text"
185
+ }
186
+ },
187
+ "ignore_above": 1024,
188
+ "type": "keyword"
189
+ },
190
+ "group": {
191
+ "properties": {
192
+ "domain": {
193
+ "ignore_above": 1024,
194
+ "type": "keyword"
195
+ },
196
+ "id": {
197
+ "ignore_above": 1024,
198
+ "type": "keyword"
199
+ },
200
+ "name": {
201
+ "ignore_above": 1024,
202
+ "type": "keyword"
203
+ }
204
+ }
205
+ },
206
+ "hash": {
207
+ "ignore_above": 1024,
208
+ "type": "keyword"
209
+ },
210
+ "id": {
211
+ "ignore_above": 1024,
212
+ "type": "keyword"
213
+ },
214
+ "name": {
215
+ "fields": {
216
+ "text": {
217
+ "norms": false,
218
+ "type": "text"
219
+ }
220
+ },
221
+ "ignore_above": 1024,
222
+ "type": "keyword"
223
+ }
224
+ }
225
+ }
226
+ }
227
+ },
228
+ "cloud": {
229
+ "properties": {
230
+ "account": {
231
+ "properties": {
232
+ "id": {
233
+ "ignore_above": 1024,
234
+ "type": "keyword"
235
+ }
236
+ }
237
+ },
238
+ "availability_zone": {
239
+ "ignore_above": 1024,
240
+ "type": "keyword"
241
+ },
242
+ "instance": {
243
+ "properties": {
244
+ "id": {
245
+ "ignore_above": 1024,
246
+ "type": "keyword"
247
+ },
248
+ "name": {
249
+ "ignore_above": 1024,
250
+ "type": "keyword"
251
+ }
252
+ }
253
+ },
254
+ "machine": {
255
+ "properties": {
256
+ "type": {
257
+ "ignore_above": 1024,
258
+ "type": "keyword"
259
+ }
260
+ }
261
+ },
262
+ "provider": {
263
+ "ignore_above": 1024,
264
+ "type": "keyword"
265
+ },
266
+ "region": {
267
+ "ignore_above": 1024,
268
+ "type": "keyword"
269
+ }
270
+ }
271
+ },
272
+ "code_signature": {
273
+ "properties": {
274
+ "exists": {
275
+ "type": "boolean"
276
+ },
277
+ "status": {
278
+ "ignore_above": 1024,
279
+ "type": "keyword"
280
+ },
281
+ "subject_name": {
282
+ "ignore_above": 1024,
283
+ "type": "keyword"
284
+ },
285
+ "trusted": {
286
+ "type": "boolean"
287
+ },
288
+ "valid": {
289
+ "type": "boolean"
290
+ }
291
+ }
292
+ },
293
+ "container": {
294
+ "properties": {
295
+ "id": {
296
+ "ignore_above": 1024,
297
+ "type": "keyword"
298
+ },
299
+ "image": {
300
+ "properties": {
301
+ "name": {
302
+ "ignore_above": 1024,
303
+ "type": "keyword"
304
+ },
305
+ "tag": {
306
+ "ignore_above": 1024,
307
+ "type": "keyword"
308
+ }
309
+ }
310
+ },
311
+ "labels": {
312
+ "type": "object"
313
+ },
314
+ "name": {
315
+ "ignore_above": 1024,
316
+ "type": "keyword"
317
+ },
318
+ "runtime": {
319
+ "ignore_above": 1024,
320
+ "type": "keyword"
321
+ }
322
+ }
323
+ },
324
+ "destination": {
325
+ "properties": {
326
+ "address": {
327
+ "ignore_above": 1024,
328
+ "type": "keyword"
329
+ },
330
+ "as": {
331
+ "properties": {
332
+ "number": {
333
+ "type": "long"
334
+ },
335
+ "organization": {
336
+ "properties": {
337
+ "name": {
338
+ "fields": {
339
+ "text": {
340
+ "norms": false,
341
+ "type": "text"
342
+ }
343
+ },
344
+ "ignore_above": 1024,
345
+ "type": "keyword"
346
+ }
347
+ }
348
+ }
349
+ }
350
+ },
351
+ "bytes": {
352
+ "type": "long"
353
+ },
354
+ "domain": {
355
+ "ignore_above": 1024,
356
+ "type": "keyword"
357
+ },
358
+ "geo": {
359
+ "properties": {
360
+ "city_name": {
361
+ "ignore_above": 1024,
362
+ "type": "keyword"
363
+ },
364
+ "continent_name": {
365
+ "ignore_above": 1024,
366
+ "type": "keyword"
367
+ },
368
+ "country_iso_code": {
369
+ "ignore_above": 1024,
370
+ "type": "keyword"
371
+ },
372
+ "country_name": {
373
+ "ignore_above": 1024,
374
+ "type": "keyword"
375
+ },
376
+ "location": {
377
+ "type": "geo_point"
378
+ },
379
+ "name": {
380
+ "ignore_above": 1024,
381
+ "type": "keyword"
382
+ },
383
+ "region_iso_code": {
384
+ "ignore_above": 1024,
385
+ "type": "keyword"
386
+ },
387
+ "region_name": {
388
+ "ignore_above": 1024,
389
+ "type": "keyword"
390
+ }
391
+ }
392
+ },
393
+ "ip": {
394
+ "type": "ip"
395
+ },
396
+ "mac": {
397
+ "ignore_above": 1024,
398
+ "type": "keyword"
399
+ },
400
+ "nat": {
401
+ "properties": {
402
+ "ip": {
403
+ "type": "ip"
404
+ },
405
+ "port": {
406
+ "type": "long"
407
+ }
408
+ }
409
+ },
410
+ "packets": {
411
+ "type": "long"
412
+ },
413
+ "port": {
414
+ "type": "long"
415
+ },
416
+ "registered_domain": {
417
+ "ignore_above": 1024,
418
+ "type": "keyword"
419
+ },
420
+ "top_level_domain": {
421
+ "ignore_above": 1024,
422
+ "type": "keyword"
423
+ },
424
+ "user": {
425
+ "properties": {
426
+ "domain": {
427
+ "ignore_above": 1024,
428
+ "type": "keyword"
429
+ },
430
+ "email": {
431
+ "ignore_above": 1024,
432
+ "type": "keyword"
433
+ },
434
+ "full_name": {
435
+ "fields": {
436
+ "text": {
437
+ "norms": false,
438
+ "type": "text"
439
+ }
440
+ },
441
+ "ignore_above": 1024,
442
+ "type": "keyword"
443
+ },
444
+ "group": {
445
+ "properties": {
446
+ "domain": {
447
+ "ignore_above": 1024,
448
+ "type": "keyword"
449
+ },
450
+ "id": {
451
+ "ignore_above": 1024,
452
+ "type": "keyword"
453
+ },
454
+ "name": {
455
+ "ignore_above": 1024,
456
+ "type": "keyword"
457
+ }
458
+ }
459
+ },
460
+ "hash": {
461
+ "ignore_above": 1024,
462
+ "type": "keyword"
463
+ },
464
+ "id": {
465
+ "ignore_above": 1024,
466
+ "type": "keyword"
467
+ },
468
+ "name": {
469
+ "fields": {
470
+ "text": {
471
+ "norms": false,
472
+ "type": "text"
473
+ }
474
+ },
475
+ "ignore_above": 1024,
476
+ "type": "keyword"
477
+ }
478
+ }
479
+ }
480
+ }
481
+ },
482
+ "dll": {
483
+ "properties": {
484
+ "code_signature": {
485
+ "properties": {
486
+ "exists": {
487
+ "type": "boolean"
488
+ },
489
+ "status": {
490
+ "ignore_above": 1024,
491
+ "type": "keyword"
492
+ },
493
+ "subject_name": {
494
+ "ignore_above": 1024,
495
+ "type": "keyword"
496
+ },
497
+ "trusted": {
498
+ "type": "boolean"
499
+ },
500
+ "valid": {
501
+ "type": "boolean"
502
+ }
503
+ }
504
+ },
505
+ "hash": {
506
+ "properties": {
507
+ "md5": {
508
+ "ignore_above": 1024,
509
+ "type": "keyword"
510
+ },
511
+ "sha1": {
512
+ "ignore_above": 1024,
513
+ "type": "keyword"
514
+ },
515
+ "sha256": {
516
+ "ignore_above": 1024,
517
+ "type": "keyword"
518
+ },
519
+ "sha512": {
520
+ "ignore_above": 1024,
521
+ "type": "keyword"
522
+ }
523
+ }
524
+ },
525
+ "name": {
526
+ "ignore_above": 1024,
527
+ "type": "keyword"
528
+ },
529
+ "path": {
530
+ "ignore_above": 1024,
531
+ "type": "keyword"
532
+ },
533
+ "pe": {
534
+ "properties": {
535
+ "company": {
536
+ "ignore_above": 1024,
537
+ "type": "keyword"
538
+ },
539
+ "description": {
540
+ "ignore_above": 1024,
541
+ "type": "keyword"
542
+ },
543
+ "file_version": {
544
+ "ignore_above": 1024,
545
+ "type": "keyword"
546
+ },
547
+ "original_file_name": {
548
+ "ignore_above": 1024,
549
+ "type": "keyword"
550
+ },
551
+ "product": {
552
+ "ignore_above": 1024,
553
+ "type": "keyword"
554
+ }
555
+ }
556
+ }
557
+ }
558
+ },
559
+ "dns": {
560
+ "properties": {
561
+ "answers": {
562
+ "properties": {
563
+ "class": {
564
+ "ignore_above": 1024,
565
+ "type": "keyword"
566
+ },
567
+ "data": {
568
+ "ignore_above": 1024,
569
+ "type": "keyword"
570
+ },
571
+ "name": {
572
+ "ignore_above": 1024,
573
+ "type": "keyword"
574
+ },
575
+ "ttl": {
576
+ "type": "long"
577
+ },
578
+ "type": {
579
+ "ignore_above": 1024,
580
+ "type": "keyword"
581
+ }
582
+ },
583
+ "type": "object"
584
+ },
585
+ "header_flags": {
586
+ "ignore_above": 1024,
587
+ "type": "keyword"
588
+ },
589
+ "id": {
590
+ "ignore_above": 1024,
591
+ "type": "keyword"
592
+ },
593
+ "op_code": {
594
+ "ignore_above": 1024,
595
+ "type": "keyword"
596
+ },
597
+ "question": {
598
+ "properties": {
599
+ "class": {
600
+ "ignore_above": 1024,
601
+ "type": "keyword"
602
+ },
603
+ "name": {
604
+ "ignore_above": 1024,
605
+ "type": "keyword"
606
+ },
607
+ "registered_domain": {
608
+ "ignore_above": 1024,
609
+ "type": "keyword"
610
+ },
611
+ "subdomain": {
612
+ "ignore_above": 1024,
613
+ "type": "keyword"
614
+ },
615
+ "top_level_domain": {
616
+ "ignore_above": 1024,
617
+ "type": "keyword"
618
+ },
619
+ "type": {
620
+ "ignore_above": 1024,
621
+ "type": "keyword"
622
+ }
623
+ }
624
+ },
625
+ "resolved_ip": {
626
+ "type": "ip"
627
+ },
628
+ "response_code": {
629
+ "ignore_above": 1024,
630
+ "type": "keyword"
631
+ },
632
+ "type": {
633
+ "ignore_above": 1024,
634
+ "type": "keyword"
635
+ }
636
+ }
637
+ },
638
+ "ecs": {
639
+ "properties": {
640
+ "version": {
641
+ "ignore_above": 1024,
642
+ "type": "keyword"
643
+ }
644
+ }
645
+ },
646
+ "error": {
647
+ "properties": {
648
+ "code": {
649
+ "ignore_above": 1024,
650
+ "type": "keyword"
651
+ },
652
+ "id": {
653
+ "ignore_above": 1024,
654
+ "type": "keyword"
655
+ },
656
+ "message": {
657
+ "norms": false,
658
+ "type": "text"
659
+ },
660
+ "stack_trace": {
661
+ "doc_values": false,
662
+ "fields": {
663
+ "text": {
664
+ "norms": false,
665
+ "type": "text"
666
+ }
667
+ },
668
+ "ignore_above": 1024,
669
+ "index": false,
670
+ "type": "keyword"
671
+ },
672
+ "type": {
673
+ "ignore_above": 1024,
674
+ "type": "keyword"
675
+ }
676
+ }
677
+ },
678
+ "event": {
679
+ "properties": {
680
+ "action": {
681
+ "ignore_above": 1024,
682
+ "type": "keyword"
683
+ },
684
+ "category": {
685
+ "ignore_above": 1024,
686
+ "type": "keyword"
687
+ },
688
+ "code": {
689
+ "ignore_above": 1024,
690
+ "type": "keyword"
691
+ },
692
+ "created": {
693
+ "type": "date"
694
+ },
695
+ "dataset": {
696
+ "ignore_above": 1024,
697
+ "type": "keyword"
698
+ },
699
+ "duration": {
700
+ "type": "long"
701
+ },
702
+ "end": {
703
+ "type": "date"
704
+ },
705
+ "hash": {
706
+ "ignore_above": 1024,
707
+ "type": "keyword"
708
+ },
709
+ "id": {
710
+ "ignore_above": 1024,
711
+ "type": "keyword"
712
+ },
713
+ "ingested": {
714
+ "type": "date"
715
+ },
716
+ "kind": {
717
+ "ignore_above": 1024,
718
+ "type": "keyword"
719
+ },
720
+ "module": {
721
+ "ignore_above": 1024,
722
+ "type": "keyword"
723
+ },
724
+ "original": {
725
+ "doc_values": false,
726
+ "ignore_above": 1024,
727
+ "index": false,
728
+ "type": "keyword"
729
+ },
730
+ "outcome": {
731
+ "ignore_above": 1024,
732
+ "type": "keyword"
733
+ },
734
+ "provider": {
735
+ "ignore_above": 1024,
736
+ "type": "keyword"
737
+ },
738
+ "reference": {
739
+ "ignore_above": 1024,
740
+ "type": "keyword"
741
+ },
742
+ "risk_score": {
743
+ "type": "float"
744
+ },
745
+ "risk_score_norm": {
746
+ "type": "float"
747
+ },
748
+ "sequence": {
749
+ "type": "long"
750
+ },
751
+ "severity": {
752
+ "type": "long"
753
+ },
754
+ "start": {
755
+ "type": "date"
756
+ },
757
+ "timezone": {
758
+ "ignore_above": 1024,
759
+ "type": "keyword"
760
+ },
761
+ "type": {
762
+ "ignore_above": 1024,
763
+ "type": "keyword"
764
+ },
765
+ "url": {
766
+ "ignore_above": 1024,
767
+ "type": "keyword"
768
+ }
769
+ }
770
+ },
771
+ "file": {
772
+ "properties": {
773
+ "accessed": {
774
+ "type": "date"
775
+ },
776
+ "attributes": {
777
+ "ignore_above": 1024,
778
+ "type": "keyword"
779
+ },
780
+ "code_signature": {
781
+ "properties": {
782
+ "exists": {
783
+ "type": "boolean"
784
+ },
785
+ "status": {
786
+ "ignore_above": 1024,
787
+ "type": "keyword"
788
+ },
789
+ "subject_name": {
790
+ "ignore_above": 1024,
791
+ "type": "keyword"
792
+ },
793
+ "trusted": {
794
+ "type": "boolean"
795
+ },
796
+ "valid": {
797
+ "type": "boolean"
798
+ }
799
+ }
800
+ },
801
+ "created": {
802
+ "type": "date"
803
+ },
804
+ "ctime": {
805
+ "type": "date"
806
+ },
807
+ "device": {
808
+ "ignore_above": 1024,
809
+ "type": "keyword"
810
+ },
811
+ "directory": {
812
+ "ignore_above": 1024,
813
+ "type": "keyword"
814
+ },
815
+ "drive_letter": {
816
+ "ignore_above": 1,
817
+ "type": "keyword"
818
+ },
819
+ "extension": {
820
+ "ignore_above": 1024,
821
+ "type": "keyword"
822
+ },
823
+ "gid": {
824
+ "ignore_above": 1024,
825
+ "type": "keyword"
826
+ },
827
+ "group": {
828
+ "ignore_above": 1024,
829
+ "type": "keyword"
830
+ },
831
+ "hash": {
832
+ "properties": {
833
+ "md5": {
834
+ "ignore_above": 1024,
835
+ "type": "keyword"
836
+ },
837
+ "sha1": {
838
+ "ignore_above": 1024,
839
+ "type": "keyword"
840
+ },
841
+ "sha256": {
842
+ "ignore_above": 1024,
843
+ "type": "keyword"
844
+ },
845
+ "sha512": {
846
+ "ignore_above": 1024,
847
+ "type": "keyword"
848
+ }
849
+ }
850
+ },
851
+ "inode": {
852
+ "ignore_above": 1024,
853
+ "type": "keyword"
854
+ },
855
+ "mime_type": {
856
+ "ignore_above": 1024,
857
+ "type": "keyword"
858
+ },
859
+ "mode": {
860
+ "ignore_above": 1024,
861
+ "type": "keyword"
862
+ },
863
+ "mtime": {
864
+ "type": "date"
865
+ },
866
+ "name": {
867
+ "ignore_above": 1024,
868
+ "type": "keyword"
869
+ },
870
+ "owner": {
871
+ "ignore_above": 1024,
872
+ "type": "keyword"
873
+ },
874
+ "path": {
875
+ "fields": {
876
+ "text": {
877
+ "norms": false,
878
+ "type": "text"
879
+ }
880
+ },
881
+ "ignore_above": 1024,
882
+ "type": "keyword"
883
+ },
884
+ "pe": {
885
+ "properties": {
886
+ "company": {
887
+ "ignore_above": 1024,
888
+ "type": "keyword"
889
+ },
890
+ "description": {
891
+ "ignore_above": 1024,
892
+ "type": "keyword"
893
+ },
894
+ "file_version": {
895
+ "ignore_above": 1024,
896
+ "type": "keyword"
897
+ },
898
+ "original_file_name": {
899
+ "ignore_above": 1024,
900
+ "type": "keyword"
901
+ },
902
+ "product": {
903
+ "ignore_above": 1024,
904
+ "type": "keyword"
905
+ }
906
+ }
907
+ },
908
+ "size": {
909
+ "type": "long"
910
+ },
911
+ "target_path": {
912
+ "fields": {
913
+ "text": {
914
+ "norms": false,
915
+ "type": "text"
916
+ }
917
+ },
918
+ "ignore_above": 1024,
919
+ "type": "keyword"
920
+ },
921
+ "type": {
922
+ "ignore_above": 1024,
923
+ "type": "keyword"
924
+ },
925
+ "uid": {
926
+ "ignore_above": 1024,
927
+ "type": "keyword"
928
+ }
929
+ }
930
+ },
931
+ "geo": {
932
+ "properties": {
933
+ "city_name": {
934
+ "ignore_above": 1024,
935
+ "type": "keyword"
936
+ },
937
+ "continent_name": {
938
+ "ignore_above": 1024,
939
+ "type": "keyword"
940
+ },
941
+ "country_iso_code": {
942
+ "ignore_above": 1024,
943
+ "type": "keyword"
944
+ },
945
+ "country_name": {
946
+ "ignore_above": 1024,
947
+ "type": "keyword"
948
+ },
949
+ "location": {
950
+ "type": "geo_point"
951
+ },
952
+ "name": {
953
+ "ignore_above": 1024,
954
+ "type": "keyword"
955
+ },
956
+ "region_iso_code": {
957
+ "ignore_above": 1024,
958
+ "type": "keyword"
959
+ },
960
+ "region_name": {
961
+ "ignore_above": 1024,
962
+ "type": "keyword"
963
+ }
964
+ }
965
+ },
966
+ "group": {
967
+ "properties": {
968
+ "domain": {
969
+ "ignore_above": 1024,
970
+ "type": "keyword"
971
+ },
972
+ "id": {
973
+ "ignore_above": 1024,
974
+ "type": "keyword"
975
+ },
976
+ "name": {
977
+ "ignore_above": 1024,
978
+ "type": "keyword"
979
+ }
980
+ }
981
+ },
982
+ "hash": {
983
+ "properties": {
984
+ "md5": {
985
+ "ignore_above": 1024,
986
+ "type": "keyword"
987
+ },
988
+ "sha1": {
989
+ "ignore_above": 1024,
990
+ "type": "keyword"
991
+ },
992
+ "sha256": {
993
+ "ignore_above": 1024,
994
+ "type": "keyword"
995
+ },
996
+ "sha512": {
997
+ "ignore_above": 1024,
998
+ "type": "keyword"
999
+ }
1000
+ }
1001
+ },
1002
+ "host": {
1003
+ "properties": {
1004
+ "architecture": {
1005
+ "ignore_above": 1024,
1006
+ "type": "keyword"
1007
+ },
1008
+ "domain": {
1009
+ "ignore_above": 1024,
1010
+ "type": "keyword"
1011
+ },
1012
+ "geo": {
1013
+ "properties": {
1014
+ "city_name": {
1015
+ "ignore_above": 1024,
1016
+ "type": "keyword"
1017
+ },
1018
+ "continent_name": {
1019
+ "ignore_above": 1024,
1020
+ "type": "keyword"
1021
+ },
1022
+ "country_iso_code": {
1023
+ "ignore_above": 1024,
1024
+ "type": "keyword"
1025
+ },
1026
+ "country_name": {
1027
+ "ignore_above": 1024,
1028
+ "type": "keyword"
1029
+ },
1030
+ "location": {
1031
+ "type": "geo_point"
1032
+ },
1033
+ "name": {
1034
+ "ignore_above": 1024,
1035
+ "type": "keyword"
1036
+ },
1037
+ "region_iso_code": {
1038
+ "ignore_above": 1024,
1039
+ "type": "keyword"
1040
+ },
1041
+ "region_name": {
1042
+ "ignore_above": 1024,
1043
+ "type": "keyword"
1044
+ }
1045
+ }
1046
+ },
1047
+ "hostname": {
1048
+ "ignore_above": 1024,
1049
+ "type": "keyword"
1050
+ },
1051
+ "id": {
1052
+ "ignore_above": 1024,
1053
+ "type": "keyword"
1054
+ },
1055
+ "ip": {
1056
+ "type": "ip"
1057
+ },
1058
+ "mac": {
1059
+ "ignore_above": 1024,
1060
+ "type": "keyword"
1061
+ },
1062
+ "name": {
1063
+ "ignore_above": 1024,
1064
+ "type": "keyword"
1065
+ },
1066
+ "os": {
1067
+ "properties": {
1068
+ "family": {
1069
+ "ignore_above": 1024,
1070
+ "type": "keyword"
1071
+ },
1072
+ "full": {
1073
+ "fields": {
1074
+ "text": {
1075
+ "norms": false,
1076
+ "type": "text"
1077
+ }
1078
+ },
1079
+ "ignore_above": 1024,
1080
+ "type": "keyword"
1081
+ },
1082
+ "kernel": {
1083
+ "ignore_above": 1024,
1084
+ "type": "keyword"
1085
+ },
1086
+ "name": {
1087
+ "fields": {
1088
+ "text": {
1089
+ "norms": false,
1090
+ "type": "text"
1091
+ }
1092
+ },
1093
+ "ignore_above": 1024,
1094
+ "type": "keyword"
1095
+ },
1096
+ "platform": {
1097
+ "ignore_above": 1024,
1098
+ "type": "keyword"
1099
+ },
1100
+ "version": {
1101
+ "ignore_above": 1024,
1102
+ "type": "keyword"
1103
+ }
1104
+ }
1105
+ },
1106
+ "type": {
1107
+ "ignore_above": 1024,
1108
+ "type": "keyword"
1109
+ },
1110
+ "uptime": {
1111
+ "type": "long"
1112
+ },
1113
+ "user": {
1114
+ "properties": {
1115
+ "domain": {
1116
+ "ignore_above": 1024,
1117
+ "type": "keyword"
1118
+ },
1119
+ "email": {
1120
+ "ignore_above": 1024,
1121
+ "type": "keyword"
1122
+ },
1123
+ "full_name": {
1124
+ "fields": {
1125
+ "text": {
1126
+ "norms": false,
1127
+ "type": "text"
1128
+ }
1129
+ },
1130
+ "ignore_above": 1024,
1131
+ "type": "keyword"
1132
+ },
1133
+ "group": {
1134
+ "properties": {
1135
+ "domain": {
1136
+ "ignore_above": 1024,
1137
+ "type": "keyword"
1138
+ },
1139
+ "id": {
1140
+ "ignore_above": 1024,
1141
+ "type": "keyword"
1142
+ },
1143
+ "name": {
1144
+ "ignore_above": 1024,
1145
+ "type": "keyword"
1146
+ }
1147
+ }
1148
+ },
1149
+ "hash": {
1150
+ "ignore_above": 1024,
1151
+ "type": "keyword"
1152
+ },
1153
+ "id": {
1154
+ "ignore_above": 1024,
1155
+ "type": "keyword"
1156
+ },
1157
+ "name": {
1158
+ "fields": {
1159
+ "text": {
1160
+ "norms": false,
1161
+ "type": "text"
1162
+ }
1163
+ },
1164
+ "ignore_above": 1024,
1165
+ "type": "keyword"
1166
+ }
1167
+ }
1168
+ }
1169
+ }
1170
+ },
1171
+ "http": {
1172
+ "properties": {
1173
+ "request": {
1174
+ "properties": {
1175
+ "body": {
1176
+ "properties": {
1177
+ "bytes": {
1178
+ "type": "long"
1179
+ },
1180
+ "content": {
1181
+ "fields": {
1182
+ "text": {
1183
+ "norms": false,
1184
+ "type": "text"
1185
+ }
1186
+ },
1187
+ "ignore_above": 1024,
1188
+ "type": "keyword"
1189
+ }
1190
+ }
1191
+ },
1192
+ "bytes": {
1193
+ "type": "long"
1194
+ },
1195
+ "method": {
1196
+ "ignore_above": 1024,
1197
+ "type": "keyword"
1198
+ },
1199
+ "referrer": {
1200
+ "ignore_above": 1024,
1201
+ "type": "keyword"
1202
+ }
1203
+ }
1204
+ },
1205
+ "response": {
1206
+ "properties": {
1207
+ "body": {
1208
+ "properties": {
1209
+ "bytes": {
1210
+ "type": "long"
1211
+ },
1212
+ "content": {
1213
+ "fields": {
1214
+ "text": {
1215
+ "norms": false,
1216
+ "type": "text"
1217
+ }
1218
+ },
1219
+ "ignore_above": 1024,
1220
+ "type": "keyword"
1221
+ }
1222
+ }
1223
+ },
1224
+ "bytes": {
1225
+ "type": "long"
1226
+ },
1227
+ "status_code": {
1228
+ "type": "long"
1229
+ }
1230
+ }
1231
+ },
1232
+ "version": {
1233
+ "ignore_above": 1024,
1234
+ "type": "keyword"
1235
+ }
1236
+ }
1237
+ },
1238
+ "interface": {
1239
+ "properties": {
1240
+ "alias": {
1241
+ "ignore_above": 1024,
1242
+ "type": "keyword"
1243
+ },
1244
+ "id": {
1245
+ "ignore_above": 1024,
1246
+ "type": "keyword"
1247
+ },
1248
+ "name": {
1249
+ "ignore_above": 1024,
1250
+ "type": "keyword"
1251
+ }
1252
+ }
1253
+ },
1254
+ "labels": {
1255
+ "type": "object"
1256
+ },
1257
+ "log": {
1258
+ "properties": {
1259
+ "level": {
1260
+ "ignore_above": 1024,
1261
+ "type": "keyword"
1262
+ },
1263
+ "logger": {
1264
+ "ignore_above": 1024,
1265
+ "type": "keyword"
1266
+ },
1267
+ "origin": {
1268
+ "properties": {
1269
+ "file": {
1270
+ "properties": {
1271
+ "line": {
1272
+ "type": "integer"
1273
+ },
1274
+ "name": {
1275
+ "ignore_above": 1024,
1276
+ "type": "keyword"
1277
+ }
1278
+ }
1279
+ },
1280
+ "function": {
1281
+ "ignore_above": 1024,
1282
+ "type": "keyword"
1283
+ }
1284
+ }
1285
+ },
1286
+ "original": {
1287
+ "doc_values": false,
1288
+ "ignore_above": 1024,
1289
+ "index": false,
1290
+ "type": "keyword"
1291
+ },
1292
+ "syslog": {
1293
+ "properties": {
1294
+ "facility": {
1295
+ "properties": {
1296
+ "code": {
1297
+ "type": "long"
1298
+ },
1299
+ "name": {
1300
+ "ignore_above": 1024,
1301
+ "type": "keyword"
1302
+ }
1303
+ }
1304
+ },
1305
+ "priority": {
1306
+ "type": "long"
1307
+ },
1308
+ "severity": {
1309
+ "properties": {
1310
+ "code": {
1311
+ "type": "long"
1312
+ },
1313
+ "name": {
1314
+ "ignore_above": 1024,
1315
+ "type": "keyword"
1316
+ }
1317
+ }
1318
+ }
1319
+ },
1320
+ "type": "object"
1321
+ }
1322
+ }
1323
+ },
1324
+ "message": {
1325
+ "norms": false,
1326
+ "type": "text"
1327
+ },
1328
+ "network": {
1329
+ "properties": {
1330
+ "application": {
1331
+ "ignore_above": 1024,
1332
+ "type": "keyword"
1333
+ },
1334
+ "bytes": {
1335
+ "type": "long"
1336
+ },
1337
+ "community_id": {
1338
+ "ignore_above": 1024,
1339
+ "type": "keyword"
1340
+ },
1341
+ "direction": {
1342
+ "ignore_above": 1024,
1343
+ "type": "keyword"
1344
+ },
1345
+ "forwarded_ip": {
1346
+ "type": "ip"
1347
+ },
1348
+ "iana_number": {
1349
+ "ignore_above": 1024,
1350
+ "type": "keyword"
1351
+ },
1352
+ "inner": {
1353
+ "properties": {
1354
+ "vlan": {
1355
+ "properties": {
1356
+ "id": {
1357
+ "ignore_above": 1024,
1358
+ "type": "keyword"
1359
+ },
1360
+ "name": {
1361
+ "ignore_above": 1024,
1362
+ "type": "keyword"
1363
+ }
1364
+ }
1365
+ }
1366
+ },
1367
+ "type": "object"
1368
+ },
1369
+ "name": {
1370
+ "ignore_above": 1024,
1371
+ "type": "keyword"
1372
+ },
1373
+ "packets": {
1374
+ "type": "long"
1375
+ },
1376
+ "protocol": {
1377
+ "ignore_above": 1024,
1378
+ "type": "keyword"
1379
+ },
1380
+ "transport": {
1381
+ "ignore_above": 1024,
1382
+ "type": "keyword"
1383
+ },
1384
+ "type": {
1385
+ "ignore_above": 1024,
1386
+ "type": "keyword"
1387
+ },
1388
+ "vlan": {
1389
+ "properties": {
1390
+ "id": {
1391
+ "ignore_above": 1024,
1392
+ "type": "keyword"
1393
+ },
1394
+ "name": {
1395
+ "ignore_above": 1024,
1396
+ "type": "keyword"
1397
+ }
1398
+ }
1399
+ }
1400
+ }
1401
+ },
1402
+ "observer": {
1403
+ "properties": {
1404
+ "egress": {
1405
+ "properties": {
1406
+ "interface": {
1407
+ "properties": {
1408
+ "alias": {
1409
+ "ignore_above": 1024,
1410
+ "type": "keyword"
1411
+ },
1412
+ "id": {
1413
+ "ignore_above": 1024,
1414
+ "type": "keyword"
1415
+ },
1416
+ "name": {
1417
+ "ignore_above": 1024,
1418
+ "type": "keyword"
1419
+ }
1420
+ }
1421
+ },
1422
+ "vlan": {
1423
+ "properties": {
1424
+ "id": {
1425
+ "ignore_above": 1024,
1426
+ "type": "keyword"
1427
+ },
1428
+ "name": {
1429
+ "ignore_above": 1024,
1430
+ "type": "keyword"
1431
+ }
1432
+ }
1433
+ },
1434
+ "zone": {
1435
+ "ignore_above": 1024,
1436
+ "type": "keyword"
1437
+ }
1438
+ },
1439
+ "type": "object"
1440
+ },
1441
+ "geo": {
1442
+ "properties": {
1443
+ "city_name": {
1444
+ "ignore_above": 1024,
1445
+ "type": "keyword"
1446
+ },
1447
+ "continent_name": {
1448
+ "ignore_above": 1024,
1449
+ "type": "keyword"
1450
+ },
1451
+ "country_iso_code": {
1452
+ "ignore_above": 1024,
1453
+ "type": "keyword"
1454
+ },
1455
+ "country_name": {
1456
+ "ignore_above": 1024,
1457
+ "type": "keyword"
1458
+ },
1459
+ "location": {
1460
+ "type": "geo_point"
1461
+ },
1462
+ "name": {
1463
+ "ignore_above": 1024,
1464
+ "type": "keyword"
1465
+ },
1466
+ "region_iso_code": {
1467
+ "ignore_above": 1024,
1468
+ "type": "keyword"
1469
+ },
1470
+ "region_name": {
1471
+ "ignore_above": 1024,
1472
+ "type": "keyword"
1473
+ }
1474
+ }
1475
+ },
1476
+ "hostname": {
1477
+ "ignore_above": 1024,
1478
+ "type": "keyword"
1479
+ },
1480
+ "ingress": {
1481
+ "properties": {
1482
+ "interface": {
1483
+ "properties": {
1484
+ "alias": {
1485
+ "ignore_above": 1024,
1486
+ "type": "keyword"
1487
+ },
1488
+ "id": {
1489
+ "ignore_above": 1024,
1490
+ "type": "keyword"
1491
+ },
1492
+ "name": {
1493
+ "ignore_above": 1024,
1494
+ "type": "keyword"
1495
+ }
1496
+ }
1497
+ },
1498
+ "vlan": {
1499
+ "properties": {
1500
+ "id": {
1501
+ "ignore_above": 1024,
1502
+ "type": "keyword"
1503
+ },
1504
+ "name": {
1505
+ "ignore_above": 1024,
1506
+ "type": "keyword"
1507
+ }
1508
+ }
1509
+ },
1510
+ "zone": {
1511
+ "ignore_above": 1024,
1512
+ "type": "keyword"
1513
+ }
1514
+ },
1515
+ "type": "object"
1516
+ },
1517
+ "ip": {
1518
+ "type": "ip"
1519
+ },
1520
+ "mac": {
1521
+ "ignore_above": 1024,
1522
+ "type": "keyword"
1523
+ },
1524
+ "name": {
1525
+ "ignore_above": 1024,
1526
+ "type": "keyword"
1527
+ },
1528
+ "os": {
1529
+ "properties": {
1530
+ "family": {
1531
+ "ignore_above": 1024,
1532
+ "type": "keyword"
1533
+ },
1534
+ "full": {
1535
+ "fields": {
1536
+ "text": {
1537
+ "norms": false,
1538
+ "type": "text"
1539
+ }
1540
+ },
1541
+ "ignore_above": 1024,
1542
+ "type": "keyword"
1543
+ },
1544
+ "kernel": {
1545
+ "ignore_above": 1024,
1546
+ "type": "keyword"
1547
+ },
1548
+ "name": {
1549
+ "fields": {
1550
+ "text": {
1551
+ "norms": false,
1552
+ "type": "text"
1553
+ }
1554
+ },
1555
+ "ignore_above": 1024,
1556
+ "type": "keyword"
1557
+ },
1558
+ "platform": {
1559
+ "ignore_above": 1024,
1560
+ "type": "keyword"
1561
+ },
1562
+ "version": {
1563
+ "ignore_above": 1024,
1564
+ "type": "keyword"
1565
+ }
1566
+ }
1567
+ },
1568
+ "product": {
1569
+ "ignore_above": 1024,
1570
+ "type": "keyword"
1571
+ },
1572
+ "serial_number": {
1573
+ "ignore_above": 1024,
1574
+ "type": "keyword"
1575
+ },
1576
+ "type": {
1577
+ "ignore_above": 1024,
1578
+ "type": "keyword"
1579
+ },
1580
+ "vendor": {
1581
+ "ignore_above": 1024,
1582
+ "type": "keyword"
1583
+ },
1584
+ "version": {
1585
+ "ignore_above": 1024,
1586
+ "type": "keyword"
1587
+ }
1588
+ }
1589
+ },
1590
+ "organization": {
1591
+ "properties": {
1592
+ "id": {
1593
+ "ignore_above": 1024,
1594
+ "type": "keyword"
1595
+ },
1596
+ "name": {
1597
+ "fields": {
1598
+ "text": {
1599
+ "norms": false,
1600
+ "type": "text"
1601
+ }
1602
+ },
1603
+ "ignore_above": 1024,
1604
+ "type": "keyword"
1605
+ }
1606
+ }
1607
+ },
1608
+ "os": {
1609
+ "properties": {
1610
+ "family": {
1611
+ "ignore_above": 1024,
1612
+ "type": "keyword"
1613
+ },
1614
+ "full": {
1615
+ "fields": {
1616
+ "text": {
1617
+ "norms": false,
1618
+ "type": "text"
1619
+ }
1620
+ },
1621
+ "ignore_above": 1024,
1622
+ "type": "keyword"
1623
+ },
1624
+ "kernel": {
1625
+ "ignore_above": 1024,
1626
+ "type": "keyword"
1627
+ },
1628
+ "name": {
1629
+ "fields": {
1630
+ "text": {
1631
+ "norms": false,
1632
+ "type": "text"
1633
+ }
1634
+ },
1635
+ "ignore_above": 1024,
1636
+ "type": "keyword"
1637
+ },
1638
+ "platform": {
1639
+ "ignore_above": 1024,
1640
+ "type": "keyword"
1641
+ },
1642
+ "version": {
1643
+ "ignore_above": 1024,
1644
+ "type": "keyword"
1645
+ }
1646
+ }
1647
+ },
1648
+ "package": {
1649
+ "properties": {
1650
+ "architecture": {
1651
+ "ignore_above": 1024,
1652
+ "type": "keyword"
1653
+ },
1654
+ "build_version": {
1655
+ "ignore_above": 1024,
1656
+ "type": "keyword"
1657
+ },
1658
+ "checksum": {
1659
+ "ignore_above": 1024,
1660
+ "type": "keyword"
1661
+ },
1662
+ "description": {
1663
+ "ignore_above": 1024,
1664
+ "type": "keyword"
1665
+ },
1666
+ "install_scope": {
1667
+ "ignore_above": 1024,
1668
+ "type": "keyword"
1669
+ },
1670
+ "installed": {
1671
+ "type": "date"
1672
+ },
1673
+ "license": {
1674
+ "ignore_above": 1024,
1675
+ "type": "keyword"
1676
+ },
1677
+ "name": {
1678
+ "ignore_above": 1024,
1679
+ "type": "keyword"
1680
+ },
1681
+ "path": {
1682
+ "ignore_above": 1024,
1683
+ "type": "keyword"
1684
+ },
1685
+ "reference": {
1686
+ "ignore_above": 1024,
1687
+ "type": "keyword"
1688
+ },
1689
+ "size": {
1690
+ "type": "long"
1691
+ },
1692
+ "type": {
1693
+ "ignore_above": 1024,
1694
+ "type": "keyword"
1695
+ },
1696
+ "version": {
1697
+ "ignore_above": 1024,
1698
+ "type": "keyword"
1699
+ }
1700
+ }
1701
+ },
1702
+ "pe": {
1703
+ "properties": {
1704
+ "company": {
1705
+ "ignore_above": 1024,
1706
+ "type": "keyword"
1707
+ },
1708
+ "description": {
1709
+ "ignore_above": 1024,
1710
+ "type": "keyword"
1711
+ },
1712
+ "file_version": {
1713
+ "ignore_above": 1024,
1714
+ "type": "keyword"
1715
+ },
1716
+ "original_file_name": {
1717
+ "ignore_above": 1024,
1718
+ "type": "keyword"
1719
+ },
1720
+ "product": {
1721
+ "ignore_above": 1024,
1722
+ "type": "keyword"
1723
+ }
1724
+ }
1725
+ },
1726
+ "process": {
1727
+ "properties": {
1728
+ "args": {
1729
+ "ignore_above": 1024,
1730
+ "type": "keyword"
1731
+ },
1732
+ "args_count": {
1733
+ "type": "long"
1734
+ },
1735
+ "code_signature": {
1736
+ "properties": {
1737
+ "exists": {
1738
+ "type": "boolean"
1739
+ },
1740
+ "status": {
1741
+ "ignore_above": 1024,
1742
+ "type": "keyword"
1743
+ },
1744
+ "subject_name": {
1745
+ "ignore_above": 1024,
1746
+ "type": "keyword"
1747
+ },
1748
+ "trusted": {
1749
+ "type": "boolean"
1750
+ },
1751
+ "valid": {
1752
+ "type": "boolean"
1753
+ }
1754
+ }
1755
+ },
1756
+ "command_line": {
1757
+ "fields": {
1758
+ "text": {
1759
+ "norms": false,
1760
+ "type": "text"
1761
+ }
1762
+ },
1763
+ "ignore_above": 1024,
1764
+ "type": "keyword"
1765
+ },
1766
+ "entity_id": {
1767
+ "ignore_above": 1024,
1768
+ "type": "keyword"
1769
+ },
1770
+ "executable": {
1771
+ "fields": {
1772
+ "text": {
1773
+ "norms": false,
1774
+ "type": "text"
1775
+ }
1776
+ },
1777
+ "ignore_above": 1024,
1778
+ "type": "keyword"
1779
+ },
1780
+ "exit_code": {
1781
+ "type": "long"
1782
+ },
1783
+ "hash": {
1784
+ "properties": {
1785
+ "md5": {
1786
+ "ignore_above": 1024,
1787
+ "type": "keyword"
1788
+ },
1789
+ "sha1": {
1790
+ "ignore_above": 1024,
1791
+ "type": "keyword"
1792
+ },
1793
+ "sha256": {
1794
+ "ignore_above": 1024,
1795
+ "type": "keyword"
1796
+ },
1797
+ "sha512": {
1798
+ "ignore_above": 1024,
1799
+ "type": "keyword"
1800
+ }
1801
+ }
1802
+ },
1803
+ "name": {
1804
+ "fields": {
1805
+ "text": {
1806
+ "norms": false,
1807
+ "type": "text"
1808
+ }
1809
+ },
1810
+ "ignore_above": 1024,
1811
+ "type": "keyword"
1812
+ },
1813
+ "parent": {
1814
+ "properties": {
1815
+ "args": {
1816
+ "ignore_above": 1024,
1817
+ "type": "keyword"
1818
+ },
1819
+ "args_count": {
1820
+ "type": "long"
1821
+ },
1822
+ "code_signature": {
1823
+ "properties": {
1824
+ "exists": {
1825
+ "type": "boolean"
1826
+ },
1827
+ "status": {
1828
+ "ignore_above": 1024,
1829
+ "type": "keyword"
1830
+ },
1831
+ "subject_name": {
1832
+ "ignore_above": 1024,
1833
+ "type": "keyword"
1834
+ },
1835
+ "trusted": {
1836
+ "type": "boolean"
1837
+ },
1838
+ "valid": {
1839
+ "type": "boolean"
1840
+ }
1841
+ }
1842
+ },
1843
+ "command_line": {
1844
+ "fields": {
1845
+ "text": {
1846
+ "norms": false,
1847
+ "type": "text"
1848
+ }
1849
+ },
1850
+ "ignore_above": 1024,
1851
+ "type": "keyword"
1852
+ },
1853
+ "entity_id": {
1854
+ "ignore_above": 1024,
1855
+ "type": "keyword"
1856
+ },
1857
+ "executable": {
1858
+ "fields": {
1859
+ "text": {
1860
+ "norms": false,
1861
+ "type": "text"
1862
+ }
1863
+ },
1864
+ "ignore_above": 1024,
1865
+ "type": "keyword"
1866
+ },
1867
+ "exit_code": {
1868
+ "type": "long"
1869
+ },
1870
+ "hash": {
1871
+ "properties": {
1872
+ "md5": {
1873
+ "ignore_above": 1024,
1874
+ "type": "keyword"
1875
+ },
1876
+ "sha1": {
1877
+ "ignore_above": 1024,
1878
+ "type": "keyword"
1879
+ },
1880
+ "sha256": {
1881
+ "ignore_above": 1024,
1882
+ "type": "keyword"
1883
+ },
1884
+ "sha512": {
1885
+ "ignore_above": 1024,
1886
+ "type": "keyword"
1887
+ }
1888
+ }
1889
+ },
1890
+ "name": {
1891
+ "fields": {
1892
+ "text": {
1893
+ "norms": false,
1894
+ "type": "text"
1895
+ }
1896
+ },
1897
+ "ignore_above": 1024,
1898
+ "type": "keyword"
1899
+ },
1900
+ "pgid": {
1901
+ "type": "long"
1902
+ },
1903
+ "pid": {
1904
+ "type": "long"
1905
+ },
1906
+ "ppid": {
1907
+ "type": "long"
1908
+ },
1909
+ "start": {
1910
+ "type": "date"
1911
+ },
1912
+ "thread": {
1913
+ "properties": {
1914
+ "id": {
1915
+ "type": "long"
1916
+ },
1917
+ "name": {
1918
+ "ignore_above": 1024,
1919
+ "type": "keyword"
1920
+ }
1921
+ }
1922
+ },
1923
+ "title": {
1924
+ "fields": {
1925
+ "text": {
1926
+ "norms": false,
1927
+ "type": "text"
1928
+ }
1929
+ },
1930
+ "ignore_above": 1024,
1931
+ "type": "keyword"
1932
+ },
1933
+ "uptime": {
1934
+ "type": "long"
1935
+ },
1936
+ "working_directory": {
1937
+ "fields": {
1938
+ "text": {
1939
+ "norms": false,
1940
+ "type": "text"
1941
+ }
1942
+ },
1943
+ "ignore_above": 1024,
1944
+ "type": "keyword"
1945
+ }
1946
+ }
1947
+ },
1948
+ "pe": {
1949
+ "properties": {
1950
+ "company": {
1951
+ "ignore_above": 1024,
1952
+ "type": "keyword"
1953
+ },
1954
+ "description": {
1955
+ "ignore_above": 1024,
1956
+ "type": "keyword"
1957
+ },
1958
+ "file_version": {
1959
+ "ignore_above": 1024,
1960
+ "type": "keyword"
1961
+ },
1962
+ "original_file_name": {
1963
+ "ignore_above": 1024,
1964
+ "type": "keyword"
1965
+ },
1966
+ "product": {
1967
+ "ignore_above": 1024,
1968
+ "type": "keyword"
1969
+ }
1970
+ }
1971
+ },
1972
+ "pgid": {
1973
+ "type": "long"
1974
+ },
1975
+ "pid": {
1976
+ "type": "long"
1977
+ },
1978
+ "ppid": {
1979
+ "type": "long"
1980
+ },
1981
+ "start": {
1982
+ "type": "date"
1983
+ },
1984
+ "thread": {
1985
+ "properties": {
1986
+ "id": {
1987
+ "type": "long"
1988
+ },
1989
+ "name": {
1990
+ "ignore_above": 1024,
1991
+ "type": "keyword"
1992
+ }
1993
+ }
1994
+ },
1995
+ "title": {
1996
+ "fields": {
1997
+ "text": {
1998
+ "norms": false,
1999
+ "type": "text"
2000
+ }
2001
+ },
2002
+ "ignore_above": 1024,
2003
+ "type": "keyword"
2004
+ },
2005
+ "uptime": {
2006
+ "type": "long"
2007
+ },
2008
+ "working_directory": {
2009
+ "fields": {
2010
+ "text": {
2011
+ "norms": false,
2012
+ "type": "text"
2013
+ }
2014
+ },
2015
+ "ignore_above": 1024,
2016
+ "type": "keyword"
2017
+ }
2018
+ }
2019
+ },
2020
+ "registry": {
2021
+ "properties": {
2022
+ "data": {
2023
+ "properties": {
2024
+ "bytes": {
2025
+ "ignore_above": 1024,
2026
+ "type": "keyword"
2027
+ },
2028
+ "strings": {
2029
+ "ignore_above": 1024,
2030
+ "type": "keyword"
2031
+ },
2032
+ "type": {
2033
+ "ignore_above": 1024,
2034
+ "type": "keyword"
2035
+ }
2036
+ }
2037
+ },
2038
+ "hive": {
2039
+ "ignore_above": 1024,
2040
+ "type": "keyword"
2041
+ },
2042
+ "key": {
2043
+ "ignore_above": 1024,
2044
+ "type": "keyword"
2045
+ },
2046
+ "path": {
2047
+ "ignore_above": 1024,
2048
+ "type": "keyword"
2049
+ },
2050
+ "value": {
2051
+ "ignore_above": 1024,
2052
+ "type": "keyword"
2053
+ }
2054
+ }
2055
+ },
2056
+ "related": {
2057
+ "properties": {
2058
+ "hash": {
2059
+ "ignore_above": 1024,
2060
+ "type": "keyword"
2061
+ },
2062
+ "ip": {
2063
+ "type": "ip"
2064
+ },
2065
+ "user": {
2066
+ "ignore_above": 1024,
2067
+ "type": "keyword"
2068
+ }
2069
+ }
2070
+ },
2071
+ "rule": {
2072
+ "properties": {
2073
+ "author": {
2074
+ "ignore_above": 1024,
2075
+ "type": "keyword"
2076
+ },
2077
+ "category": {
2078
+ "ignore_above": 1024,
2079
+ "type": "keyword"
2080
+ },
2081
+ "description": {
2082
+ "ignore_above": 1024,
2083
+ "type": "keyword"
2084
+ },
2085
+ "id": {
2086
+ "ignore_above": 1024,
2087
+ "type": "keyword"
2088
+ },
2089
+ "license": {
2090
+ "ignore_above": 1024,
2091
+ "type": "keyword"
2092
+ },
2093
+ "name": {
2094
+ "ignore_above": 1024,
2095
+ "type": "keyword"
2096
+ },
2097
+ "reference": {
2098
+ "ignore_above": 1024,
2099
+ "type": "keyword"
2100
+ },
2101
+ "ruleset": {
2102
+ "ignore_above": 1024,
2103
+ "type": "keyword"
2104
+ },
2105
+ "uuid": {
2106
+ "ignore_above": 1024,
2107
+ "type": "keyword"
2108
+ },
2109
+ "version": {
2110
+ "ignore_above": 1024,
2111
+ "type": "keyword"
2112
+ }
2113
+ }
2114
+ },
2115
+ "server": {
2116
+ "properties": {
2117
+ "address": {
2118
+ "ignore_above": 1024,
2119
+ "type": "keyword"
2120
+ },
2121
+ "as": {
2122
+ "properties": {
2123
+ "number": {
2124
+ "type": "long"
2125
+ },
2126
+ "organization": {
2127
+ "properties": {
2128
+ "name": {
2129
+ "fields": {
2130
+ "text": {
2131
+ "norms": false,
2132
+ "type": "text"
2133
+ }
2134
+ },
2135
+ "ignore_above": 1024,
2136
+ "type": "keyword"
2137
+ }
2138
+ }
2139
+ }
2140
+ }
2141
+ },
2142
+ "bytes": {
2143
+ "type": "long"
2144
+ },
2145
+ "domain": {
2146
+ "ignore_above": 1024,
2147
+ "type": "keyword"
2148
+ },
2149
+ "geo": {
2150
+ "properties": {
2151
+ "city_name": {
2152
+ "ignore_above": 1024,
2153
+ "type": "keyword"
2154
+ },
2155
+ "continent_name": {
2156
+ "ignore_above": 1024,
2157
+ "type": "keyword"
2158
+ },
2159
+ "country_iso_code": {
2160
+ "ignore_above": 1024,
2161
+ "type": "keyword"
2162
+ },
2163
+ "country_name": {
2164
+ "ignore_above": 1024,
2165
+ "type": "keyword"
2166
+ },
2167
+ "location": {
2168
+ "type": "geo_point"
2169
+ },
2170
+ "name": {
2171
+ "ignore_above": 1024,
2172
+ "type": "keyword"
2173
+ },
2174
+ "region_iso_code": {
2175
+ "ignore_above": 1024,
2176
+ "type": "keyword"
2177
+ },
2178
+ "region_name": {
2179
+ "ignore_above": 1024,
2180
+ "type": "keyword"
2181
+ }
2182
+ }
2183
+ },
2184
+ "ip": {
2185
+ "type": "ip"
2186
+ },
2187
+ "mac": {
2188
+ "ignore_above": 1024,
2189
+ "type": "keyword"
2190
+ },
2191
+ "nat": {
2192
+ "properties": {
2193
+ "ip": {
2194
+ "type": "ip"
2195
+ },
2196
+ "port": {
2197
+ "type": "long"
2198
+ }
2199
+ }
2200
+ },
2201
+ "packets": {
2202
+ "type": "long"
2203
+ },
2204
+ "port": {
2205
+ "type": "long"
2206
+ },
2207
+ "registered_domain": {
2208
+ "ignore_above": 1024,
2209
+ "type": "keyword"
2210
+ },
2211
+ "top_level_domain": {
2212
+ "ignore_above": 1024,
2213
+ "type": "keyword"
2214
+ },
2215
+ "user": {
2216
+ "properties": {
2217
+ "domain": {
2218
+ "ignore_above": 1024,
2219
+ "type": "keyword"
2220
+ },
2221
+ "email": {
2222
+ "ignore_above": 1024,
2223
+ "type": "keyword"
2224
+ },
2225
+ "full_name": {
2226
+ "fields": {
2227
+ "text": {
2228
+ "norms": false,
2229
+ "type": "text"
2230
+ }
2231
+ },
2232
+ "ignore_above": 1024,
2233
+ "type": "keyword"
2234
+ },
2235
+ "group": {
2236
+ "properties": {
2237
+ "domain": {
2238
+ "ignore_above": 1024,
2239
+ "type": "keyword"
2240
+ },
2241
+ "id": {
2242
+ "ignore_above": 1024,
2243
+ "type": "keyword"
2244
+ },
2245
+ "name": {
2246
+ "ignore_above": 1024,
2247
+ "type": "keyword"
2248
+ }
2249
+ }
2250
+ },
2251
+ "hash": {
2252
+ "ignore_above": 1024,
2253
+ "type": "keyword"
2254
+ },
2255
+ "id": {
2256
+ "ignore_above": 1024,
2257
+ "type": "keyword"
2258
+ },
2259
+ "name": {
2260
+ "fields": {
2261
+ "text": {
2262
+ "norms": false,
2263
+ "type": "text"
2264
+ }
2265
+ },
2266
+ "ignore_above": 1024,
2267
+ "type": "keyword"
2268
+ }
2269
+ }
2270
+ }
2271
+ }
2272
+ },
2273
+ "service": {
2274
+ "properties": {
2275
+ "ephemeral_id": {
2276
+ "ignore_above": 1024,
2277
+ "type": "keyword"
2278
+ },
2279
+ "id": {
2280
+ "ignore_above": 1024,
2281
+ "type": "keyword"
2282
+ },
2283
+ "name": {
2284
+ "ignore_above": 1024,
2285
+ "type": "keyword"
2286
+ },
2287
+ "node": {
2288
+ "properties": {
2289
+ "name": {
2290
+ "ignore_above": 1024,
2291
+ "type": "keyword"
2292
+ }
2293
+ }
2294
+ },
2295
+ "state": {
2296
+ "ignore_above": 1024,
2297
+ "type": "keyword"
2298
+ },
2299
+ "type": {
2300
+ "ignore_above": 1024,
2301
+ "type": "keyword"
2302
+ },
2303
+ "version": {
2304
+ "ignore_above": 1024,
2305
+ "type": "keyword"
2306
+ }
2307
+ }
2308
+ },
2309
+ "source": {
2310
+ "properties": {
2311
+ "address": {
2312
+ "ignore_above": 1024,
2313
+ "type": "keyword"
2314
+ },
2315
+ "as": {
2316
+ "properties": {
2317
+ "number": {
2318
+ "type": "long"
2319
+ },
2320
+ "organization": {
2321
+ "properties": {
2322
+ "name": {
2323
+ "fields": {
2324
+ "text": {
2325
+ "norms": false,
2326
+ "type": "text"
2327
+ }
2328
+ },
2329
+ "ignore_above": 1024,
2330
+ "type": "keyword"
2331
+ }
2332
+ }
2333
+ }
2334
+ }
2335
+ },
2336
+ "bytes": {
2337
+ "type": "long"
2338
+ },
2339
+ "domain": {
2340
+ "ignore_above": 1024,
2341
+ "type": "keyword"
2342
+ },
2343
+ "geo": {
2344
+ "properties": {
2345
+ "city_name": {
2346
+ "ignore_above": 1024,
2347
+ "type": "keyword"
2348
+ },
2349
+ "continent_name": {
2350
+ "ignore_above": 1024,
2351
+ "type": "keyword"
2352
+ },
2353
+ "country_iso_code": {
2354
+ "ignore_above": 1024,
2355
+ "type": "keyword"
2356
+ },
2357
+ "country_name": {
2358
+ "ignore_above": 1024,
2359
+ "type": "keyword"
2360
+ },
2361
+ "location": {
2362
+ "type": "geo_point"
2363
+ },
2364
+ "name": {
2365
+ "ignore_above": 1024,
2366
+ "type": "keyword"
2367
+ },
2368
+ "region_iso_code": {
2369
+ "ignore_above": 1024,
2370
+ "type": "keyword"
2371
+ },
2372
+ "region_name": {
2373
+ "ignore_above": 1024,
2374
+ "type": "keyword"
2375
+ }
2376
+ }
2377
+ },
2378
+ "ip": {
2379
+ "type": "ip"
2380
+ },
2381
+ "mac": {
2382
+ "ignore_above": 1024,
2383
+ "type": "keyword"
2384
+ },
2385
+ "nat": {
2386
+ "properties": {
2387
+ "ip": {
2388
+ "type": "ip"
2389
+ },
2390
+ "port": {
2391
+ "type": "long"
2392
+ }
2393
+ }
2394
+ },
2395
+ "packets": {
2396
+ "type": "long"
2397
+ },
2398
+ "port": {
2399
+ "type": "long"
2400
+ },
2401
+ "registered_domain": {
2402
+ "ignore_above": 1024,
2403
+ "type": "keyword"
2404
+ },
2405
+ "top_level_domain": {
2406
+ "ignore_above": 1024,
2407
+ "type": "keyword"
2408
+ },
2409
+ "user": {
2410
+ "properties": {
2411
+ "domain": {
2412
+ "ignore_above": 1024,
2413
+ "type": "keyword"
2414
+ },
2415
+ "email": {
2416
+ "ignore_above": 1024,
2417
+ "type": "keyword"
2418
+ },
2419
+ "full_name": {
2420
+ "fields": {
2421
+ "text": {
2422
+ "norms": false,
2423
+ "type": "text"
2424
+ }
2425
+ },
2426
+ "ignore_above": 1024,
2427
+ "type": "keyword"
2428
+ },
2429
+ "group": {
2430
+ "properties": {
2431
+ "domain": {
2432
+ "ignore_above": 1024,
2433
+ "type": "keyword"
2434
+ },
2435
+ "id": {
2436
+ "ignore_above": 1024,
2437
+ "type": "keyword"
2438
+ },
2439
+ "name": {
2440
+ "ignore_above": 1024,
2441
+ "type": "keyword"
2442
+ }
2443
+ }
2444
+ },
2445
+ "hash": {
2446
+ "ignore_above": 1024,
2447
+ "type": "keyword"
2448
+ },
2449
+ "id": {
2450
+ "ignore_above": 1024,
2451
+ "type": "keyword"
2452
+ },
2453
+ "name": {
2454
+ "fields": {
2455
+ "text": {
2456
+ "norms": false,
2457
+ "type": "text"
2458
+ }
2459
+ },
2460
+ "ignore_above": 1024,
2461
+ "type": "keyword"
2462
+ }
2463
+ }
2464
+ }
2465
+ }
2466
+ },
2467
+ "tags": {
2468
+ "ignore_above": 1024,
2469
+ "type": "keyword"
2470
+ },
2471
+ "threat": {
2472
+ "properties": {
2473
+ "framework": {
2474
+ "ignore_above": 1024,
2475
+ "type": "keyword"
2476
+ },
2477
+ "tactic": {
2478
+ "properties": {
2479
+ "id": {
2480
+ "ignore_above": 1024,
2481
+ "type": "keyword"
2482
+ },
2483
+ "name": {
2484
+ "ignore_above": 1024,
2485
+ "type": "keyword"
2486
+ },
2487
+ "reference": {
2488
+ "ignore_above": 1024,
2489
+ "type": "keyword"
2490
+ }
2491
+ }
2492
+ },
2493
+ "technique": {
2494
+ "properties": {
2495
+ "id": {
2496
+ "ignore_above": 1024,
2497
+ "type": "keyword"
2498
+ },
2499
+ "name": {
2500
+ "fields": {
2501
+ "text": {
2502
+ "norms": false,
2503
+ "type": "text"
2504
+ }
2505
+ },
2506
+ "ignore_above": 1024,
2507
+ "type": "keyword"
2508
+ },
2509
+ "reference": {
2510
+ "ignore_above": 1024,
2511
+ "type": "keyword"
2512
+ }
2513
+ }
2514
+ }
2515
+ }
2516
+ },
2517
+ "tls": {
2518
+ "properties": {
2519
+ "cipher": {
2520
+ "ignore_above": 1024,
2521
+ "type": "keyword"
2522
+ },
2523
+ "client": {
2524
+ "properties": {
2525
+ "certificate": {
2526
+ "ignore_above": 1024,
2527
+ "type": "keyword"
2528
+ },
2529
+ "certificate_chain": {
2530
+ "ignore_above": 1024,
2531
+ "type": "keyword"
2532
+ },
2533
+ "hash": {
2534
+ "properties": {
2535
+ "md5": {
2536
+ "ignore_above": 1024,
2537
+ "type": "keyword"
2538
+ },
2539
+ "sha1": {
2540
+ "ignore_above": 1024,
2541
+ "type": "keyword"
2542
+ },
2543
+ "sha256": {
2544
+ "ignore_above": 1024,
2545
+ "type": "keyword"
2546
+ }
2547
+ }
2548
+ },
2549
+ "issuer": {
2550
+ "ignore_above": 1024,
2551
+ "type": "keyword"
2552
+ },
2553
+ "ja3": {
2554
+ "ignore_above": 1024,
2555
+ "type": "keyword"
2556
+ },
2557
+ "not_after": {
2558
+ "type": "date"
2559
+ },
2560
+ "not_before": {
2561
+ "type": "date"
2562
+ },
2563
+ "server_name": {
2564
+ "ignore_above": 1024,
2565
+ "type": "keyword"
2566
+ },
2567
+ "subject": {
2568
+ "ignore_above": 1024,
2569
+ "type": "keyword"
2570
+ },
2571
+ "supported_ciphers": {
2572
+ "ignore_above": 1024,
2573
+ "type": "keyword"
2574
+ }
2575
+ }
2576
+ },
2577
+ "curve": {
2578
+ "ignore_above": 1024,
2579
+ "type": "keyword"
2580
+ },
2581
+ "established": {
2582
+ "type": "boolean"
2583
+ },
2584
+ "next_protocol": {
2585
+ "ignore_above": 1024,
2586
+ "type": "keyword"
2587
+ },
2588
+ "resumed": {
2589
+ "type": "boolean"
2590
+ },
2591
+ "server": {
2592
+ "properties": {
2593
+ "certificate": {
2594
+ "ignore_above": 1024,
2595
+ "type": "keyword"
2596
+ },
2597
+ "certificate_chain": {
2598
+ "ignore_above": 1024,
2599
+ "type": "keyword"
2600
+ },
2601
+ "hash": {
2602
+ "properties": {
2603
+ "md5": {
2604
+ "ignore_above": 1024,
2605
+ "type": "keyword"
2606
+ },
2607
+ "sha1": {
2608
+ "ignore_above": 1024,
2609
+ "type": "keyword"
2610
+ },
2611
+ "sha256": {
2612
+ "ignore_above": 1024,
2613
+ "type": "keyword"
2614
+ }
2615
+ }
2616
+ },
2617
+ "issuer": {
2618
+ "ignore_above": 1024,
2619
+ "type": "keyword"
2620
+ },
2621
+ "ja3s": {
2622
+ "ignore_above": 1024,
2623
+ "type": "keyword"
2624
+ },
2625
+ "not_after": {
2626
+ "type": "date"
2627
+ },
2628
+ "not_before": {
2629
+ "type": "date"
2630
+ },
2631
+ "subject": {
2632
+ "ignore_above": 1024,
2633
+ "type": "keyword"
2634
+ }
2635
+ }
2636
+ },
2637
+ "version": {
2638
+ "ignore_above": 1024,
2639
+ "type": "keyword"
2640
+ },
2641
+ "version_protocol": {
2642
+ "ignore_above": 1024,
2643
+ "type": "keyword"
2644
+ }
2645
+ }
2646
+ },
2647
+ "trace": {
2648
+ "properties": {
2649
+ "id": {
2650
+ "ignore_above": 1024,
2651
+ "type": "keyword"
2652
+ }
2653
+ }
2654
+ },
2655
+ "transaction": {
2656
+ "properties": {
2657
+ "id": {
2658
+ "ignore_above": 1024,
2659
+ "type": "keyword"
2660
+ }
2661
+ }
2662
+ },
2663
+ "url": {
2664
+ "properties": {
2665
+ "domain": {
2666
+ "ignore_above": 1024,
2667
+ "type": "keyword"
2668
+ },
2669
+ "extension": {
2670
+ "ignore_above": 1024,
2671
+ "type": "keyword"
2672
+ },
2673
+ "fragment": {
2674
+ "ignore_above": 1024,
2675
+ "type": "keyword"
2676
+ },
2677
+ "full": {
2678
+ "fields": {
2679
+ "text": {
2680
+ "norms": false,
2681
+ "type": "text"
2682
+ }
2683
+ },
2684
+ "ignore_above": 1024,
2685
+ "type": "keyword"
2686
+ },
2687
+ "original": {
2688
+ "fields": {
2689
+ "text": {
2690
+ "norms": false,
2691
+ "type": "text"
2692
+ }
2693
+ },
2694
+ "ignore_above": 1024,
2695
+ "type": "keyword"
2696
+ },
2697
+ "password": {
2698
+ "ignore_above": 1024,
2699
+ "type": "keyword"
2700
+ },
2701
+ "path": {
2702
+ "ignore_above": 1024,
2703
+ "type": "keyword"
2704
+ },
2705
+ "port": {
2706
+ "type": "long"
2707
+ },
2708
+ "query": {
2709
+ "ignore_above": 1024,
2710
+ "type": "keyword"
2711
+ },
2712
+ "registered_domain": {
2713
+ "ignore_above": 1024,
2714
+ "type": "keyword"
2715
+ },
2716
+ "scheme": {
2717
+ "ignore_above": 1024,
2718
+ "type": "keyword"
2719
+ },
2720
+ "top_level_domain": {
2721
+ "ignore_above": 1024,
2722
+ "type": "keyword"
2723
+ },
2724
+ "username": {
2725
+ "ignore_above": 1024,
2726
+ "type": "keyword"
2727
+ }
2728
+ }
2729
+ },
2730
+ "user": {
2731
+ "properties": {
2732
+ "domain": {
2733
+ "ignore_above": 1024,
2734
+ "type": "keyword"
2735
+ },
2736
+ "email": {
2737
+ "ignore_above": 1024,
2738
+ "type": "keyword"
2739
+ },
2740
+ "full_name": {
2741
+ "fields": {
2742
+ "text": {
2743
+ "norms": false,
2744
+ "type": "text"
2745
+ }
2746
+ },
2747
+ "ignore_above": 1024,
2748
+ "type": "keyword"
2749
+ },
2750
+ "group": {
2751
+ "properties": {
2752
+ "domain": {
2753
+ "ignore_above": 1024,
2754
+ "type": "keyword"
2755
+ },
2756
+ "id": {
2757
+ "ignore_above": 1024,
2758
+ "type": "keyword"
2759
+ },
2760
+ "name": {
2761
+ "ignore_above": 1024,
2762
+ "type": "keyword"
2763
+ }
2764
+ }
2765
+ },
2766
+ "hash": {
2767
+ "ignore_above": 1024,
2768
+ "type": "keyword"
2769
+ },
2770
+ "id": {
2771
+ "ignore_above": 1024,
2772
+ "type": "keyword"
2773
+ },
2774
+ "name": {
2775
+ "fields": {
2776
+ "text": {
2777
+ "norms": false,
2778
+ "type": "text"
2779
+ }
2780
+ },
2781
+ "ignore_above": 1024,
2782
+ "type": "keyword"
2783
+ }
2784
+ }
2785
+ },
2786
+ "user_agent": {
2787
+ "properties": {
2788
+ "device": {
2789
+ "properties": {
2790
+ "name": {
2791
+ "ignore_above": 1024,
2792
+ "type": "keyword"
2793
+ }
2794
+ }
2795
+ },
2796
+ "name": {
2797
+ "ignore_above": 1024,
2798
+ "type": "keyword"
2799
+ },
2800
+ "original": {
2801
+ "fields": {
2802
+ "text": {
2803
+ "norms": false,
2804
+ "type": "text"
2805
+ }
2806
+ },
2807
+ "ignore_above": 1024,
2808
+ "type": "keyword"
2809
+ },
2810
+ "os": {
2811
+ "properties": {
2812
+ "family": {
2813
+ "ignore_above": 1024,
2814
+ "type": "keyword"
2815
+ },
2816
+ "full": {
2817
+ "fields": {
2818
+ "text": {
2819
+ "norms": false,
2820
+ "type": "text"
2821
+ }
2822
+ },
2823
+ "ignore_above": 1024,
2824
+ "type": "keyword"
2825
+ },
2826
+ "kernel": {
2827
+ "ignore_above": 1024,
2828
+ "type": "keyword"
2829
+ },
2830
+ "name": {
2831
+ "fields": {
2832
+ "text": {
2833
+ "norms": false,
2834
+ "type": "text"
2835
+ }
2836
+ },
2837
+ "ignore_above": 1024,
2838
+ "type": "keyword"
2839
+ },
2840
+ "platform": {
2841
+ "ignore_above": 1024,
2842
+ "type": "keyword"
2843
+ },
2844
+ "version": {
2845
+ "ignore_above": 1024,
2846
+ "type": "keyword"
2847
+ }
2848
+ }
2849
+ },
2850
+ "version": {
2851
+ "ignore_above": 1024,
2852
+ "type": "keyword"
2853
+ }
2854
+ }
2855
+ },
2856
+ "vlan": {
2857
+ "properties": {
2858
+ "id": {
2859
+ "ignore_above": 1024,
2860
+ "type": "keyword"
2861
+ },
2862
+ "name": {
2863
+ "ignore_above": 1024,
2864
+ "type": "keyword"
2865
+ }
2866
+ }
2867
+ },
2868
+ "vulnerability": {
2869
+ "properties": {
2870
+ "category": {
2871
+ "ignore_above": 1024,
2872
+ "type": "keyword"
2873
+ },
2874
+ "classification": {
2875
+ "ignore_above": 1024,
2876
+ "type": "keyword"
2877
+ },
2878
+ "description": {
2879
+ "fields": {
2880
+ "text": {
2881
+ "norms": false,
2882
+ "type": "text"
2883
+ }
2884
+ },
2885
+ "ignore_above": 1024,
2886
+ "type": "keyword"
2887
+ },
2888
+ "enumeration": {
2889
+ "ignore_above": 1024,
2890
+ "type": "keyword"
2891
+ },
2892
+ "id": {
2893
+ "ignore_above": 1024,
2894
+ "type": "keyword"
2895
+ },
2896
+ "reference": {
2897
+ "ignore_above": 1024,
2898
+ "type": "keyword"
2899
+ },
2900
+ "report_id": {
2901
+ "ignore_above": 1024,
2902
+ "type": "keyword"
2903
+ },
2904
+ "scanner": {
2905
+ "properties": {
2906
+ "vendor": {
2907
+ "ignore_above": 1024,
2908
+ "type": "keyword"
2909
+ }
2910
+ }
2911
+ },
2912
+ "score": {
2913
+ "properties": {
2914
+ "base": {
2915
+ "type": "float"
2916
+ },
2917
+ "environmental": {
2918
+ "type": "float"
2919
+ },
2920
+ "temporal": {
2921
+ "type": "float"
2922
+ },
2923
+ "version": {
2924
+ "ignore_above": 1024,
2925
+ "type": "keyword"
2926
+ }
2927
+ }
2928
+ },
2929
+ "severity": {
2930
+ "ignore_above": 1024,
2931
+ "type": "keyword"
2932
+ }
2933
+ }
2934
+ }
2935
+ }
2936
+ },
2937
+ "order": 1,
2938
+ "settings": {
2939
+ "index": {
2940
+ "mapping": {
2941
+ "total_fields": {
2942
+ "limit": 10000
2943
+ }
2944
+ },
2945
+ "refresh_interval": "5s"
2946
+ }
2947
+ }
2948
+ }