I would like to map only 5 or so fields in the incoming data, the rest I do not care about
How would my mapping look like then ?
Right now it looks like this:
PUT /_template/tobias2-all-audit
{
"order" : 0,
"version" : 60001,
"index_patterns" : [
"tobias2-all-audit-*"
],
"settings" : {
"index" : {
"lifecycle" : {
"name" : "audit_policy",
"rollover_alias" : "all-audit"
},
"number_of_shards" : "1",
"refresh_interval" : "5s"
}
},
"mappings" : {
"properties" : {
"@timestamp" : {
"type" : "date"
},
"measured_time" : {
"type" : "long"
},
"severity" : {
"type" : "long"
},
"@version" : {
"type" : "keyword"
},
"message" : {
"type" : "text"
},
"service_name" : {
"type" : "text"
},
"method" : {
"type" : "text"
}
}
},
"aliases" : { }
}