{
  "index_patterns": ["witfoo-*"],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.mapping.total_fields.limit": 2000
    },
    "mappings": {
      "properties": {
        "id": { "type": "keyword" },
        "hash": { "type": "keyword" },
        "org_id": { "type": "keyword" },
        "appliance_id": { "type": "keyword" },
        "action": { "type": "keyword" },
        "application": { "type": "keyword" },
        "clientIP": { "type": "ip" },
        "clientPort": { "type": "keyword" },
        "clientHostname": { "type": "keyword" },
        "clientMAC": { "type": "keyword" },
        "clientBytes": { "type": "long" },
        "clientPackets": { "type": "long" },
        "serverIP": { "type": "ip" },
        "serverPort": { "type": "keyword" },
        "serverHostname": { "type": "keyword" },
        "serverMAC": { "type": "keyword" },
        "serverBytes": { "type": "long" },
        "serverPackets": { "type": "long" },
        "protocol": { "type": "keyword" },
        "totalBytes": { "type": "long" },
        "userName": { "type": "keyword" },
        "emailFrom": { "type": "keyword" },
        "emailTo": { "type": "keyword" },
        "emailSubject": { "type": "text", "fields": { "keyword": { "type": "keyword" } } },
        "emailClient": { "type": "keyword" },
        "emailSendingServer": { "type": "keyword" },
        "fileName": { "type": "keyword" },
        "fileHash": { "type": "keyword" },
        "filePath": { "type": "text", "fields": { "keyword": { "type": "keyword" } } },
        "message": { "type": "text" },
        "streamName": { "type": "keyword" },
        "messageType": { "type": "keyword" },
        "severityCode": { "type": "integer" },
        "severityLabel": { "type": "keyword" },
        "senderHost": { "type": "keyword" },
        "sourceInfo": { "type": "keyword" },
        "program": { "type": "keyword" },
        "pid": { "type": "keyword" },
        "ruleName": { "type": "text", "fields": { "keyword": { "type": "keyword" } } },
        "ruleCategory": { "type": "keyword" },
        "cve": { "type": "keyword" },
        "cveDescription": { "type": "text" },
        "uri": { "type": "text", "fields": { "keyword": { "type": "keyword" } } },
        "fqdn": { "type": "keyword" },
        "geoRegion": { "type": "keyword" },
        "vendorCode": { "type": "keyword" },
        "facilityCode": { "type": "keyword" },
        "facilityLabel": { "type": "keyword" },
        "priority": { "type": "keyword" },
        "startTimeUTC": { "type": "date" },
        "endTimeUTC": { "type": "date" },
        "matchedLeadRules": { "type": "integer" },
        "attackTechniqueIds": { "type": "keyword" },
        "stixIndicatorIds": { "type": "keyword" },
        "tags": { "type": "keyword" },
        "matchedPredicateRules": { "type": "integer" },
        "productIds": { "type": "integer" },
        "clientSetIds": { "type": "integer" },
        "serverSetIds": { "type": "integer" },
        "fileSetIds": { "type": "integer" },
        "userSetIds": { "type": "integer" }
      }
    }
  },
  "priority": 200
}