{
  "index_patterns": ["web-*"],
  "priority": 100,
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0,
      "index.codec": "best_compression",
      "refresh_interval": "5s",
      "index.default_pipeline": "geoip-web"
    },
    "mappings": {
      "dynamic_templates": [
        { "strings_as_keyword": { "match_mapping_type": "string", "mapping": { "type": "keyword", "ignore_above": 1024 } } }
      ],
      "properties": {
        "@timestamp": { "type": "date" },
        "message":    { "type": "text" },
        "source": { "properties": {
          "ip":   { "type": "ip" },
          "port": { "type": "integer" },
          "geo":  { "properties": { "location": { "type": "geo_point" } } },
          "as":   { "properties": { "number": { "type": "long" } } }
        } },
        "http": { "properties": {
          "response": { "properties": {
            "status_code": { "type": "integer" },
            "body": { "properties": { "bytes": { "type": "long" } } }
          } }
        } },
        "url":        { "properties": { "original": { "type": "keyword", "ignore_above": 2048, "fields": { "text": { "type": "text" } } } } },
        "user_agent": { "properties": { "original": { "type": "keyword", "ignore_above": 1024, "fields": { "text": { "type": "text" } } } } },
        "event":      { "properties": { "duration": { "type": "long" } } },
        "log":        { "properties": { "syslog": { "properties": { "priority": { "type": "integer" } } } } }
      }
    }
  }
}