I was not able to to attach the template because the character limitations.
Template
[PUT _template/fwsw_1
{
"index_patterns": ["logstash-firewall-syslog-sidewinder-*"],
"settings": {
"number_of_shards": 5
},
"mappings": {
"_source": {
"enabled": false
},
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "keyword"
},
"app_categories": {
"type": "keyword"
},
"app_risk": {
"type": "keyword"
},
"application": {
"type": "keyword"
},
"area": {
"type": "keyword"
},
"attackip": {
"type": "ip"
},
"attackzone": {
"type": "keyword"
},
"bytes_written_to_client": {
"type": "long"
},
"bytes_written_to_server": {
"type": "long"
},
"cache_hit": {
"type": "integer"
},
"category": {
"type": "keyword"
},
"cky_i": {
"type": "keyword"
},
"cky_r": {
"type": "keyword"
},
"cmd": {
"type": "keyword"
},
"config_area": {
"type": "keyword"
},
"config_item": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"cpu_data": {
"type": "integer"
},
"dst_geo": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"dstip": {
"type": "ip"
},
"dstport": {
"type": "integer"
},
"dstzone": {
"type": "keyword"
},
"event": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"fac": {
"type": "keyword"
},
"geoip": {
"dynamic": "true",
"properties": {
"city_name": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"continent_code": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"country_code2": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"country_code3": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"country_name": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ip": {
"type": "ip"
},
"latitude": {
"type": "half_float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "half_float"
},
"postal_code": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"region_code": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"region_name": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"timezone": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"host": {
"type": "keyword"
},
"hostname": {
"type": "keyword"
},
"ibytes": {
"type": "long"
},
"information": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"interface": {
"type": "keyword"
},
"ipkt": {
"type": "integer"
},
"load_data": {
"type": "integer"
},
"local_gw": {
"type": "ip"
},
"local_net": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"logid": {
"type": "integer"
},
"logsource": {
"type": "keyword"
},
"mbuf_data": {
"type": "integer"
},
"msg_id": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"netsessid": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"obytes": {
"type": "long"
},
"opkt": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"pid": {
"type": "keyword"
},
"pri": {
"type": "keyword"
},
"program": {
"type": "keyword"
},
"protocol": {
"type": "keyword"
},
"real_data": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"reason": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"remote_gw": {
"type": "ip"
},
"remote_id": {
"type": "keyword"
},
"remote_logname": {
"type": "keyword"
},
"remote_net": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"request_command": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"rule_name": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"spi": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"src_geo": {
"type": "keyword"
},
"srcip": {
"type": "ip"
},
"srcport": {
"type": "integer"
},
"srczone": {
"type": "keyword"
},
"ssl_name": {
"type": "keyword"
},
"syslog5424_pri": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"total_events": {
"type": "integer"
},
"type": {
"type": "keyword"
},
"udb_action": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"udb_class": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"udb_user": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"user_name": {
"type": "keyword"
},
"virt_data": {
"type": "integer"
},
"vpn_name": {
"type": "keyword"
}
}
}
}