{
  "template": "yaf_index*",
  "mappings": {
    "yaf_doc": {
      "_timestamp": {
        "enabled": true
      },
      "dynamic_templates": [
      {
        "geo_location_point": {
          "match": "enrichments:geo:*:location_point",
          "match_mapping_type": "*",
          "mapping": {
            "type": "geo_point"
          }
        }
      },
      {
        "geo_country": {
          "match": "enrichments:geo:*:country",
          "match_mapping_type": "*",
          "mapping": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      },
      {
        "geo_city": {
          "match": "enrichments:geo:*:city",
          "match_mapping_type": "*",
          "mapping": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      },
      {
        "geo_location_id": {
          "match": "enrichments:geo:*:locID",
          "match_mapping_type": "*",
          "mapping": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      },
      {
        "geo_dma_code": {
          "match": "enrichments:geo:*:dmaCode",
          "match_mapping_type": "*",
          "mapping": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      },
      {
        "geo_postal_code": {
          "match": "enrichments:geo:*:postalCode",
          "match_mapping_type": "*",
          "mapping": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      },
      {
        "geo_latitude": {
          "match": "enrichments:geo:*:latitude",
          "match_mapping_type": "*",
          "mapping": {
            "type": "float"
          }
        }
      },
      {
        "geo_longitude": {
          "match": "enrichments:geo:*:longitude",
          "match_mapping_type": "*",
          "mapping": {
            "type": "float"
          }
        }
      },
      {
        "timestamps": {
          "match": "*:ts",
          "match_mapping_type": "*",
          "mapping": {
            "type": "date",
            "format": "epoch_millis"
          }
        }
      },
      {
        "threat_triage_score": {
          "mapping": {
            "type": "float"
          },
          "match": "threat:triage:*score",
          "match_mapping_type": "*"
        }
      },
      {
        "threat_triage_reason": {
          "mapping": {
            "type": "string"
          },
          "match": "threat:triage:rules:*:reason",
          "match_mapping_type": "*"
        }
      },
      {
        "threat_triage_name": {
          "mapping": {
            "type": "string"
          },
          "match": "threat:triage:rules:*:name",
          "match_mapping_type": "*"
        }
      }
      ],
      "properties": {
        "timestamp": {
          "type": "date",
          "format": "epoch_millis"
        },
        "source:type": {
          "type": "string",
          "index": "not_analyzed"
        },
        "ip_dst_addr": {
          "type": "ip"
        },
        "ip_dst_port": {
          "type": "integer"
        },
        "ip_src_addr": {
          "type": "ip"
        },
        "ip_src_port": {
          "type": "integer"
        },
        "start_time": {
          "type": "date",
          "format": "epoch_millis"
        },
        "end_time": {
          "type": "date",
          "format": "epoch_millis"
        },
        "duration": {
          "type": "double"
        },
        "rtt": {
          "type": "double"
        },
        "proto": {
          "type": "string",
          "index": "not_analyzed"
        },
        "sip": {
          "type": "string",
          "index": "not_analyzed"
        },
        "sp": {
          "type": "string",
          "index": "not_analyzed"
        },
        "dip": {
          "type": "string",
          "index": "not_analyzed"
        },
        "dp": {
          "type": "string",
          "index": "not_analyzed"
        },
        "iflags": {
          "type": "string",
          "index": "not_analyzed"
        },
        "uflags": {
          "type": "string",
          "index": "not_analyzed"
        },
        "riflags": {
          "type": "string"
        },
        "ruflags": {
          "type": "string",
          "index": "not_analyzed"
        },
        "isn": {
          "type": "string",
          "index": "not_analyzed"
        },
        "risn": {
          "type": "string",
          "index": "not_analyzed"
        },
        "tag": {
          "type": "string",
          "index": "not_analyzed"
        },
        "rtag": {
          "type": "string",
          "index": "not_analyzed"
        },
        "pkt": {
          "type": "integer"
        },
        "oct": {
          "type": "integer"
        },
        "rpkt": {
          "type": "integer"
        },
        "roct": {
          "type": "integer"
        },
        "app": {
          "type": "string",
          "index": "not_analyzed"
        },
        "end-reason": {
          "type": "string"
        },
        "alert": {
          "type": "nested"
        }
      }
    }
  }
}