{
  "index_patterns": ["falco-*"],
  "priority": 100,
  "template": {
    "settings": {
      "index": {
        "number_of_shards": 1,
        "number_of_replicas": 0,
        "codec": "best_compression",
        "refresh_interval": "5s"
      }
    },
    "mappings": {
      "properties": {
        "time":     { "type": "date" },
        "rule":     { "type": "keyword" },
        "priority": { "type": "keyword" },
        "source":   { "type": "keyword" },
        "hostname": { "type": "keyword" },
        "tags":     { "type": "keyword" },
        "output":   { "type": "text" }
      }
    }
  }
}