honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-03-30 03:48:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

use doc_values for most fields in audit indices

Browse Source 
This changes the mappings for the audit indices to use doc_values for all fields
other than the request_body, which will have a lot of variance. Additionally, the
request_body field is no longer indexed.

Closes elastic/elasticsearch#918

Original commit: elastic/x-pack-elasticsearch@4917529ffa
This commit is contained in:
jaymode 2015-06-23 08:21:06 -04:00
parent f0d5c2da61
commit d65bfd1721
1 changed files with 34 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
src/main/resources/shield_audit_log.json
View File

@ -13,70 +13,87 @@
"properties": { "properties": {
"@timestamp": { "@timestamp": {
"type": "date", "type": "date",
"format": "date_time" "format": "date_time",
"doc_values": true
}, },
"node_name": { "node_name": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"node_host_name": { "node_host_name": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"node_host_address": { "node_host_address": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"layer": { "layer": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"event_type": { "event_type": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"origin_address": { "origin_address": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"origin_type": { "origin_type": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"principal": { "principal": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"action": { "action": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"indices": { "indices": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"request": { "request": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"request_body": { "request_body": {
"type": "string" "type": "string",
"index": "no"
}, },
"uri": { "uri": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"realm": { "realm": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"transport_profile": { "transport_profile": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
}, },
"rule": { "rule": {
"type": "string", "type": "string",
"index": "not_analyzed" "index": "not_analyzed",
"doc_values": true
} }
} }
} }