“hits” : [
{
“_index”: “xxx-xxx-date”,
“_type”: “_doc”,
“_id”: “xxx”,
“_score”: 1.0,
“_source”: {
“sequence”: {
“number”: “25001”
},
“event”: {
“type” : “message rejected indication”,
“description”: “”xxxxxxx””
},
“type”: “snmptrap”,
“session”: {
“id”: “xxxx” },
version:
time:
@timestamp:
level:
host:
method:
date:
“Snmpv2”:
“message”: “xxxxxxxxx”} },
Mapping:
Inde name : {
“mappings”: {
_mets: {},
Properties: {
timestamp:{
type: date
},
@version: {
type: “ text”
fields: {
Keyword : {
type: “keyword”,
“Ignore_above” : 256
}}
“Snmpv2::enterprise”: {
“Properties”: {
“18494”: {
Properties ............
........
........ etc.