API tools faq
paste
Advertisement
Guest User

Index Mapping

a guest
Nov 20th, 2017
300
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.49 KB | None | 0 0
raw download clone embed print report
  1. {
  2. "winlogbeat-2017.11.21": {
  3. "mappings": {
  4. "wineventlog": {
  5. "properties": {
  6. "@timestamp": {
  7. "type": "date"
  8. },
  9. "@version": {
  10. "type": "text",
  11. "fields": {
  12. "keyword": {
  13. "type": "keyword",
  14. "ignore_above": 256
  15. }
  16. }
  17. },
  18. "beat": {
  19. "properties": {
  20. "hostname": {
  21. "type": "text",
  22. "fields": {
  23. "keyword": {
  24. "type": "keyword",
  25. "ignore_above": 256
  26. }
  27. }
  28. },
  29. "name": {
  30. "type": "text",
  31. "fields": {
  32. "keyword": {
  33. "type": "keyword",
  34. "ignore_above": 256
  35. }
  36. }
  37. },
  38. "version": {
  39. "type": "text",
  40. "fields": {
  41. "keyword": {
  42. "type": "keyword",
  43. "ignore_above": 256
  44. }
  45. }
  46. }
  47. }
  48. },
  49. "computer_name": {
  50. "type": "text",
  51. "fields": {
  52. "keyword": {
  53. "type": "keyword",
  54. "ignore_above": 256
  55. }
  56. }
  57. },
  58. "event_data": {
  59. "properties": {
  60. "AccessList": {
  61. "type": "text",
  62. "fields": {
  63. "keyword": {
  64. "type": "keyword",
  65. "ignore_above": 256
  66. }
  67. }
  68. },
  69. "AccessMask": {
  70. "type": "text",
  71. "fields": {
  72. "keyword": {
  73. "type": "keyword",
  74. "ignore_above": 256
  75. }
  76. }
  77. },
  78. "AccessReason": {
  79. "type": "text",
  80. "fields": {
  81. "keyword": {
  82. "type": "keyword",
  83. "ignore_above": 256
  84. }
  85. }
  86. },
  87. "AccountExpires": {
  88. "type": "text",
  89. "fields": {
  90. "keyword": {
  91. "type": "keyword",
  92. "ignore_above": 256
  93. }
  94. }
  95. },
  96. "AllowedToDelegateTo": {
  97. "type": "text",
  98. "fields": {
  99. "keyword": {
  100. "type": "keyword",
  101. "ignore_above": 256
  102. }
  103. }
  104. },
  105. "AuditPolicyChanges": {
  106. "type": "text",
  107. "fields": {
  108. "keyword": {
  109. "type": "keyword",
  110. "ignore_above": 256
  111. }
  112. }
  113. },
  114. "AuthenticationPackageName": {
  115. "type": "text",
  116. "fields": {
  117. "keyword": {
  118. "type": "keyword",
  119. "ignore_above": 256
  120. }
  121. }
  122. },
  123. "CategoryId": {
  124. "type": "text",
  125. "fields": {
  126. "keyword": {
  127. "type": "keyword",
  128. "ignore_above": 256
  129. }
  130. }
  131. },
  132. "ComputerAccountChange": {
  133. "type": "text",
  134. "fields": {
  135. "keyword": {
  136. "type": "keyword",
  137. "ignore_above": 256
  138. }
  139. }
  140. },
  141. "DisplayName": {
  142. "type": "text",
  143. "fields": {
  144. "keyword": {
  145. "type": "keyword",
  146. "ignore_above": 256
  147. }
  148. }
  149. },
  150. "DnsHostName": {
  151. "type": "text",
  152. "fields": {
  153. "keyword": {
  154. "type": "keyword",
  155. "ignore_above": 256
  156. }
  157. }
  158. },
  159. "Dummy": {
  160. "type": "text",
  161. "fields": {
  162. "keyword": {
  163. "type": "keyword",
  164. "ignore_above": 256
  165. }
  166. }
  167. },
  168. "ErrorCode": {
  169. "type": "text",
  170. "fields": {
  171. "keyword": {
  172. "type": "keyword",
  173. "ignore_above": 256
  174. }
  175. }
  176. },
  177. "FailureReason": {
  178. "type": "text",
  179. "fields": {
  180. "keyword": {
  181. "type": "keyword",
  182. "ignore_above": 256
  183. }
  184. }
  185. },
  186. "GPOList": {
  187. "type": "text",
  188. "fields": {
  189. "keyword": {
  190. "type": "keyword",
  191. "ignore_above": 256
  192. }
  193. }
  194. },
  195. "HandleId": {
  196. "type": "text",
  197. "fields": {
  198. "keyword": {
  199. "type": "keyword",
  200. "ignore_above": 256
  201. }
  202. }
  203. },
  204. "HomeDirectory": {
  205. "type": "text",
  206. "fields": {
  207. "keyword": {
  208. "type": "keyword",
  209. "ignore_above": 256
  210. }
  211. }
  212. },
  213. "HomePath": {
  214. "type": "text",
  215. "fields": {
  216. "keyword": {
  217. "type": "keyword",
  218. "ignore_above": 256
  219. }
  220. }
  221. },
  222. "ImpersonationLevel": {
  223. "type": "text",
  224. "fields": {
  225. "keyword": {
  226. "type": "keyword",
  227. "ignore_above": 256
  228. }
  229. }
  230. },
  231. "IpAddress": {
  232. "type": "text",
  233. "fields": {
  234. "keyword": {
  235. "type": "keyword",
  236. "ignore_above": 256
  237. }
  238. }
  239. },
  240. "IpPort": {
  241. "type": "text",
  242. "fields": {
  243. "keyword": {
  244. "type": "keyword",
  245. "ignore_above": 256
  246. }
  247. }
  248. },
  249. "KeyLength": {
  250. "type": "text",
  251. "fields": {
  252. "keyword": {
  253. "type": "keyword",
  254. "ignore_above": 256
  255. }
  256. }
  257. },
  258. "LmPackageName": {
  259. "type": "text",
  260. "fields": {
  261. "keyword": {
  262. "type": "keyword",
  263. "ignore_above": 256
  264. }
  265. }
  266. },
  267. "LogonGuid": {
  268. "type": "text",
  269. "fields": {
  270. "keyword": {
  271. "type": "keyword",
  272. "ignore_above": 256
  273. }
  274. }
  275. },
  276. "LogonHours": {
  277. "type": "text",
  278. "fields": {
  279. "keyword": {
  280. "type": "keyword",
  281. "ignore_above": 256
  282. }
  283. }
  284. },
  285. "LogonProcessName": {
  286. "type": "text",
  287. "fields": {
  288. "keyword": {
  289. "type": "keyword",
  290. "ignore_above": 256
  291. }
  292. }
  293. },
  294. "LogonType": {
  295. "type": "text",
  296. "fields": {
  297. "keyword": {
  298. "type": "keyword",
  299. "ignore_above": 256
  300. }
  301. }
  302. },
  303. "NewState": {
  304. "type": "text",
  305. "fields": {
  306. "keyword": {
  307. "type": "keyword",
  308. "ignore_above": 256
  309. }
  310. }
  311. },
  312. "NewUacValue": {
  313. "type": "text",
  314. "fields": {
  315. "keyword": {
  316. "type": "keyword",
  317. "ignore_above": 256
  318. }
  319. }
  320. },
  321. "ObjectName": {
  322. "type": "text",
  323. "fields": {
  324. "keyword": {
  325. "type": "keyword",
  326. "ignore_above": 256
  327. }
  328. }
  329. },
  330. "ObjectServer": {
  331. "type": "text",
  332. "fields": {
  333. "keyword": {
  334. "type": "keyword",
  335. "ignore_above": 256
  336. }
  337. }
  338. },
  339. "ObjectType": {
  340. "type": "text",
  341. "fields": {
  342. "keyword": {
  343. "type": "keyword",
  344. "ignore_above": 256
  345. }
  346. }
  347. },
  348. "OldUacValue": {
  349. "type": "text",
  350. "fields": {
  351. "keyword": {
  352. "type": "keyword",
  353. "ignore_above": 256
  354. }
  355. }
  356. },
  357. "PasswordLastSet": {
  358. "type": "text",
  359. "fields": {
  360. "keyword": {
  361. "type": "keyword",
  362. "ignore_above": 256
  363. }
  364. }
  365. },
  366. "PrimaryGroupId": {
  367. "type": "text",
  368. "fields": {
  369. "keyword": {
  370. "type": "keyword",
  371. "ignore_above": 256
  372. }
  373. }
  374. },
  375. "PrivilegeList": {
  376. "type": "text",
  377. "fields": {
  378. "keyword": {
  379. "type": "keyword",
  380. "ignore_above": 256
  381. }
  382. }
  383. },
  384. "ProcessId": {
  385. "type": "text",
  386. "fields": {
  387. "keyword": {
  388. "type": "keyword",
  389. "ignore_above": 256
  390. }
  391. }
  392. },
  393. "ProcessName": {
  394. "type": "text",
  395. "fields": {
  396. "keyword": {
  397. "type": "keyword",
  398. "ignore_above": 256
  399. }
  400. }
  401. },
  402. "ProfilePath": {
  403. "type": "text",
  404. "fields": {
  405. "keyword": {
  406. "type": "keyword",
  407. "ignore_above": 256
  408. }
  409. }
  410. },
  411. "RelativeTargetName": {
  412. "type": "text",
  413. "fields": {
  414. "keyword": {
  415. "type": "keyword",
  416. "ignore_above": 256
  417. }
  418. }
  419. },
  420. "ResourceAttributes": {
  421. "type": "text",
  422. "fields": {
  423. "keyword": {
  424. "type": "keyword",
  425. "ignore_above": 256
  426. }
  427. }
  428. },
  429. "ResourceManager": {
  430. "type": "text",
  431. "fields": {
  432. "keyword": {
  433. "type": "keyword",
  434. "ignore_above": 256
  435. }
  436. }
  437. },
  438. "SamAccountName": {
  439. "type": "text",
  440. "fields": {
  441. "keyword": {
  442. "type": "keyword",
  443. "ignore_above": 256
  444. }
  445. }
  446. },
  447. "ScriptPath": {
  448. "type": "text",
  449. "fields": {
  450. "keyword": {
  451. "type": "keyword",
  452. "ignore_above": 256
  453. }
  454. }
  455. },
  456. "ServiceName": {
  457. "type": "text",
  458. "fields": {
  459. "keyword": {
  460. "type": "keyword",
  461. "ignore_above": 256
  462. }
  463. }
  464. },
  465. "ServicePrincipalNames": {
  466. "type": "text",
  467. "fields": {
  468. "keyword": {
  469. "type": "keyword",
  470. "ignore_above": 256
  471. }
  472. }
  473. },
  474. "ServiceSid": {
  475. "type": "text",
  476. "fields": {
  477. "keyword": {
  478. "type": "keyword",
  479. "ignore_above": 256
  480. }
  481. }
  482. },
  483. "ShareLocalPath": {
  484. "type": "text",
  485. "fields": {
  486. "keyword": {
  487. "type": "keyword",
  488. "ignore_above": 256
  489. }
  490. }
  491. },
  492. "ShareName": {
  493. "type": "text",
  494. "fields": {
  495. "keyword": {
  496. "type": "keyword",
  497. "ignore_above": 256
  498. }
  499. }
  500. },
  501. "SidHistory": {
  502. "type": "text",
  503. "fields": {
  504. "keyword": {
  505. "type": "keyword",
  506. "ignore_above": 256
  507. }
  508. }
  509. },
  510. "Status": {
  511. "type": "text",
  512. "fields": {
  513. "keyword": {
  514. "type": "keyword",
  515. "ignore_above": 256
  516. }
  517. }
  518. },
  519. "SubStatus": {
  520. "type": "text",
  521. "fields": {
  522. "keyword": {
  523. "type": "keyword",
  524. "ignore_above": 256
  525. }
  526. }
  527. },
  528. "SubcategoryGuid": {
  529. "type": "text",
  530. "fields": {
  531. "keyword": {
  532. "type": "keyword",
  533. "ignore_above": 256
  534. }
  535. }
  536. },
  537. "SubcategoryId": {
  538. "type": "text",
  539. "fields": {
  540. "keyword": {
  541. "type": "keyword",
  542. "ignore_above": 256
  543. }
  544. }
  545. },
  546. "SubjectDomainName": {
  547. "type": "text",
  548. "fields": {
  549. "keyword": {
  550. "type": "keyword",
  551. "ignore_above": 256
  552. }
  553. }
  554. },
  555. "SubjectLogonId": {
  556. "type": "text",
  557. "fields": {
  558. "keyword": {
  559. "type": "keyword",
  560. "ignore_above": 256
  561. }
  562. }
  563. },
  564. "SubjectUserName": {
  565. "type": "text",
  566. "fields": {
  567. "keyword": {
  568. "type": "keyword",
  569. "ignore_above": 256
  570. }
  571. }
  572. },
  573. "SubjectUserSid": {
  574. "type": "text",
  575. "fields": {
  576. "keyword": {
  577. "type": "keyword",
  578. "ignore_above": 256
  579. }
  580. }
  581. },
  582. "TargetDomainName": {
  583. "type": "text",
  584. "fields": {
  585. "keyword": {
  586. "type": "keyword",
  587. "ignore_above": 256
  588. }
  589. }
  590. },
  591. "TargetInfo": {
  592. "type": "text",
  593. "fields": {
  594. "keyword": {
  595. "type": "keyword",
  596. "ignore_above": 256
  597. }
  598. }
  599. },
  600. "TargetLogonGuid": {
  601. "type": "text",
  602. "fields": {
  603. "keyword": {
  604. "type": "keyword",
  605. "ignore_above": 256
  606. }
  607. }
  608. },
  609. "TargetLogonId": {
  610. "type": "text",
  611. "fields": {
  612. "keyword": {
  613. "type": "keyword",
  614. "ignore_above": 256
  615. }
  616. }
  617. },
  618. "TargetServerName": {
  619. "type": "text",
  620. "fields": {
  621. "keyword": {
  622. "type": "keyword",
  623. "ignore_above": 256
  624. }
  625. }
  626. },
  627. "TargetSid": {
  628. "type": "text",
  629. "fields": {
  630. "keyword": {
  631. "type": "keyword",
  632. "ignore_above": 256
  633. }
  634. }
  635. },
  636. "TargetUserName": {
  637. "type": "text",
  638. "fields": {
  639. "keyword": {
  640. "type": "keyword",
  641. "ignore_above": 256
  642. }
  643. }
  644. },
  645. "TargetUserSid": {
  646. "type": "text",
  647. "fields": {
  648. "keyword": {
  649. "type": "keyword",
  650. "ignore_above": 256
  651. }
  652. }
  653. },
  654. "TicketEncryptionType": {
  655. "type": "text",
  656. "fields": {
  657. "keyword": {
  658. "type": "keyword",
  659. "ignore_above": 256
  660. }
  661. }
  662. },
  663. "TicketOptions": {
  664. "type": "text",
  665. "fields": {
  666. "keyword": {
  667. "type": "keyword",
  668. "ignore_above": 256
  669. }
  670. }
  671. },
  672. "TransactionId": {
  673. "type": "text",
  674. "fields": {
  675. "keyword": {
  676. "type": "keyword",
  677. "ignore_above": 256
  678. }
  679. }
  680. },
  681. "TransmittedServices": {
  682. "type": "text",
  683. "fields": {
  684. "keyword": {
  685. "type": "keyword",
  686. "ignore_above": 256
  687. }
  688. }
  689. },
  690. "UserAccountControl": {
  691. "type": "text",
  692. "fields": {
  693. "keyword": {
  694. "type": "keyword",
  695. "ignore_above": 256
  696. }
  697. }
  698. },
  699. "UserParameters": {
  700. "type": "text",
  701. "fields": {
  702. "keyword": {
  703. "type": "keyword",
  704. "ignore_above": 256
  705. }
  706. }
  707. },
  708. "UserPrincipalName": {
  709. "type": "text",
  710. "fields": {
  711. "keyword": {
  712. "type": "keyword",
  713. "ignore_above": 256
  714. }
  715. }
  716. },
  717. "UserWorkstations": {
  718. "type": "text",
  719. "fields": {
  720. "keyword": {
  721. "type": "keyword",
  722. "ignore_above": 256
  723. }
  724. }
  725. },
  726. "Workstation": {
  727. "type": "text",
  728. "fields": {
  729. "keyword": {
  730. "type": "keyword",
  731. "ignore_above": 256
  732. }
  733. }
  734. },
  735. "WorkstationName": {
  736. "type": "text",
  737. "fields": {
  738. "keyword": {
  739. "type": "keyword",
  740. "ignore_above": 256
  741. }
  742. }
  743. }
  744. }
  745. },
  746. "event_id": {
  747. "type": "long"
  748. },
  749. "host": {
  750. "type": "text",
  751. "fields": {
  752. "keyword": {
  753. "type": "keyword",
  754. "ignore_above": 256
  755. }
  756. }
  757. },
  758. "indexType": {
  759. "type": "text",
  760. "fields": {
  761. "keyword": {
  762. "type": "keyword",
  763. "ignore_above": 256
  764. }
  765. }
  766. },
  767. "keywords": {
  768. "type": "text",
  769. "fields": {
  770. "keyword": {
  771. "type": "keyword",
  772. "ignore_above": 256
  773. }
  774. }
  775. },
  776. "level": {
  777. "type": "text",
  778. "fields": {
  779. "keyword": {
  780. "type": "keyword",
  781. "ignore_above": 256
  782. }
  783. }
  784. },
  785. "log_name": {
  786. "type": "text",
  787. "fields": {
  788. "keyword": {
  789. "type": "keyword",
  790. "ignore_above": 256
  791. }
  792. }
  793. },
  794. "message": {
  795. "type": "text",
  796. "fields": {
  797. "keyword": {
  798. "type": "keyword",
  799. "ignore_above": 256
  800. }
  801. }
  802. },
  803. "opcode": {
  804. "type": "text",
  805. "fields": {
  806. "keyword": {
  807. "type": "keyword",
  808. "ignore_above": 256
  809. }
  810. }
  811. },
  812. "process_id": {
  813. "type": "long"
  814. },
  815. "provider_guid": {
  816. "type": "text",
  817. "fields": {
  818. "keyword": {
  819. "type": "keyword",
  820. "ignore_above": 256
  821. }
  822. }
  823. },
  824. "record_number": {
  825. "type": "text",
  826. "fields": {
  827. "keyword": {
  828. "type": "keyword",
  829. "ignore_above": 256
  830. }
  831. }
  832. },
  833. "source_name": {
  834. "type": "text",
  835. "fields": {
  836. "keyword": {
  837. "type": "keyword",
  838. "ignore_above": 256
  839. }
  840. }
  841. },
  842. "tags": {
  843. "type": "text",
  844. "fields": {
  845. "keyword": {
  846. "type": "keyword",
  847. "ignore_above": 256
  848. }
  849. }
  850. },
  851. "task": {
  852. "type": "text",
  853. "fields": {
  854. "keyword": {
  855. "type": "keyword",
  856. "ignore_above": 256
  857. }
  858. }
  859. },
  860. "thread_id": {
  861. "type": "long"
  862. },
  863. "type": {
  864. "type": "text",
  865. "fields": {
  866. "keyword": {
  867. "type": "keyword",
  868. "ignore_above": 256
  869. }
  870. }
  871. },
  872. "version": {
  873. "type": "long"
  874. }
  875. }
  876. }
  877. }
  878. }
  879. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!