{
  "order": 0,
  "template": "clog-*",
  "settings": {
    "index": {
      "mapping": {
        "total_fields": {
          "limit": "2000"
        }
      },
      "refresh_interval": "5s",
      "number_of_shards": "7",
      "number_of_replicas": "1"
    }
  },
  "mappings": {
    "_default_": {
      "dynamic_templates": [{
        "message_field": {
          "mapping": {
            "index": "false",
            "type": "text"
          },
          "match_mapping_type": "text",
          "match": "message"
        }
      }, {
        "text_fields": {
          "mapping": {
            "index": "false",
            "type": "text"
          },
          "match_mapping_type": "text",
          "match": "*"
        }
      }],
      "_all": {
        "enabled": false
      },
      "properties": {
        "geoip": {
          "dynamic": true,
          "type": "object",
          "properties": {
            "location": {
              "type": "geo_point"
            }
          }
        },
        "subject_decoded": {
          "type": "text"
        },
        "bytes_in": {
          "type": "long"
        },
        "user_name": {
          "type": "text",
          "fields": {
           "keyword": {
             "type": "keyword",
             "ignore_above" : 256
           }
         }
        },
        "login": {
          "type": "text",
          "fields": {
           "keyword": {
             "type": "keyword",
             "ignore_above" : 256
           }
         }
        },
        "source_ip": {
          "type": "ip"
        },
        "local_ip": {
          "type": "ip"
        },
        "@timestamp": {
          "format": "dateOptionalTime",
          "type": "date"
        },
        "bytes_out": {
          "type": "long"
        },
        "size": {
          "type": "long"
        },
        "blacklist_ip": {
          "type": "ip"
        },
        "@version": {
          "index": "not_analyzed",
          "type": "integer"
        },
        "host": {
          "index": "not_analyzed",
          "type": "text"
        }
      }
    }
  },
  "aliases": {}
}