No, it should show something like:
{
"test123" : {
"mappings" : {
"properties" : {
"action" : {
"type" : "text"
},
"authenticationtype" : {
"type" : "text"
},
"device" : {
"type" : "keyword"
},
"duration" : {
"type" : "integer"
},
"hosttype" : {
"type" : "text"
},
"ipaddress" : {
"type" : "keyword"
},
"message" : {
"type" : "text"
},
"providertype" : {
"type" : "text"
},
"result" : {
"type" : "text"
},
"timestamp" : {
"type" : "date",
"format" : "yyyy-MM-dd HH:mm:ss,SSS"
},
"typemfa" : {
"type" : "text"
},
"unknown1" : {
"type" : "text"
},
"unknown2" : {
"type" : "text"
}
}
}
}
}