Please disregard. I was able to get a Component Template to work. I went through and copied all settings (other than mappings), and it now works. I suspect perhaps the "version" : 35
setting? I originally had "version" : 1
.
Here is my working Component Template for SIEM Signals:
PUT _index_template/.siem-signals-default
{
"index_patterns" : [
".siem-signals-default-*"
],
"template" : {
"settings" : {
"index" : {
"lifecycle" : {
"name" : ".siem-signals-default",
"rollover_alias" : ".siem-signals-default"
},
"mapping" : {
"total_fields" : {
"limit" : "10000"
}
}
}
},
"mappings" : {
"_meta": {
"version": 35
},
"dynamic": false,
"properties" : {
"_score" : {
"type" : "long"
}
}
},
"aliases" : {}
},
"composed_of" : [
"@timestamp",
"@version",
"document_id",
"agent",
"as",
"client",
"cloud",
"code_signature",
"container",
"destination",
"dll",
"dns",
"ecs",
"error",
"event",
"file",
"geo",
"group",
"hash",
"host",
"http",
"interface",
"labels",
"log",
"logstash",
"message",
"network",
"observer",
"organization",
"os",
"package",
"pe",
"process",
"registry",
"related",
"rule",
"server",
"service",
"signal",
"source",
"span",
"tags",
"threat",
"tls",
"trace",
"transaction",
"url",
"user",
"user_agent",
"vlan",
"vulnerability",
"windows",
"winlog"
],
"version" : 35,
"_meta" : {
"description" : "SIEM Signals Component-Based Template"
}
}