metron-platform/metron-solr/metron-solr-common/src/test/resources/config/test/conf/managed-schema

<?xml version="1.0" encoding="UTF-8" ?>
<!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
 this work for additional information regarding copyright ownership.
 The ASF licenses this file to You under the Apache License, Version 2.0
 (the "License"); you may not use this file except in compliance with
 the License.  You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-->
<schema name="example" version="1.6">
  <field name="_version_" type="plong" indexed="false" stored="false"/>

  <!-- points to the root document of a block of nested documents. Required for nested
     document support, may be removed otherwise
  -->
  <field name="_root_" type="string" indexed="true" stored="false" docValues="false"/>

  <!-- Only remove the "id" field if you have a very good reason to. While not strictly
    required, it is highly recommended. A <uniqueKey> is present in almost all Solr
    installations. See the <uniqueKey> declaration below where <uniqueKey> is set to "id".
    Do NOT change the type and apply index-time analysis to the <uniqueKey> as it will likely
    make routing in SolrCloud and document replacement in general fail. Limited _query_ time
    analysis is possible as long as the indexing process is guaranteed to index the term
    in a compatible way. Any analysis applied to the <uniqueKey> should _not_ produce multiple
    tokens
  -->
  <field name="guid" type="string" indexed="true" stored="true" required="true"
    multiValued="false"/>

  <field name="source.type" type="string" indexed="true" stored="true"/>
  <field name="name" type="string" indexed="true" stored="true"/>
  <field name="timestamp" type="plong" indexed="true" stored="true"/>
  <field name="new-field" type="string" indexed="true" stored="true"/>
  <field name="metaalerts" type="string" multiValued="true" indexed="true" stored="true"/>
  <field name="threat:triage:score" type="pdouble" indexed="true" stored="true"/>
  <field name="score" type="pdouble" indexed="true" stored="true"/>


  <!-- Comments field required for the UI -->
  <field name="comments" type="string" indexed="true" stored="true" multiValued="true"/>

  <dynamicField name="*" type="ignored" multiValued="false" docValues="true"/>


  <!-- Field to use to determine and enforce document uniqueness.
       Unless this field is marked with required="false", it will be a required field
    -->
  <uniqueKey>guid</uniqueKey>


  <!-- field type definitions. The "name" attribute is
     just a label to be used by field definitions.  The "class"
     attribute and any other attributes determine the real
     behavior of the fieldType.
       Class names starting with "solr" refer to java classes in a
     standard package such as org.apache.solr.analysis
  -->

  <!-- The StrField type is not analyzed, but indexed/stored verbatim. -->
  <fieldType name="string" class="solr.StrField" sortMissingLast="true"/>
  <fieldType name="boolean" class="solr.BoolField" sortMissingLast="true"/>
  <fieldType name="pint" class="solr.IntPointField" docValues="true"/>
  <fieldType name="pfloat" class="solr.FloatPointField" docValues="true"/>
  <fieldType name="plong" class="solr.LongPointField" docValues="true"/>
  <fieldType name="pdouble" class="solr.DoublePointField" docValues="true"/>
  <fieldType name="ignored" stored="false" indexed="false" multiValued="true"
    class="solr.StrField"/>

</schema>