{
  "template": "bro_index*",
  "mappings": {
    "bro_doc": {
      "_timestamp": {
        "enabled": true
      },
      "dynamic_templates": [
        {
          "geo_location_point": {
            "match": "enrichments:geo:*:location_point",
            "match_mapping_type": "*",
            "mapping": {
              "type": "geo_point"
            }
          }
        },
        {
          "geo_country": {
            "match": "enrichments:geo:*:country",
            "match_mapping_type": "*",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        },
        {
          "geo_city": {
            "match": "enrichments:geo:*:city",
            "match_mapping_type": "*",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        },
        {
          "geo_location_id": {
            "match": "enrichments:geo:*:locID",
            "match_mapping_type": "*",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        },
        {
          "geo_dma_code": {
            "match": "enrichments:geo:*:dmaCode",
            "match_mapping_type": "*",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        },
        {
          "geo_postal_code": {
            "match": "enrichments:geo:*:postalCode",
            "match_mapping_type": "*",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        },
        {
          "geo_latitude": {
            "match": "enrichments:geo:*:latitude",
            "match_mapping_type": "*",
            "mapping": {
              "type": "float"
            }
          }
        },
        {
          "geo_longitude": {
            "match": "enrichments:geo:*:longitude",
            "match_mapping_type": "*",
            "mapping": {
              "type": "float"
            }
          }
        },
        {
          "timestamps": {
            "match": "*:ts",
            "match_mapping_type": "*",
            "mapping": {
              "type": "date",
              "format": "epoch_millis"
            }
          }
        }
      ],
      "properties": {
        "timestamp": {
          "type": "date",
          "format": "epoch_millis"
        },
        "source:type": {
          "type": "string",
          "index": "not_analyzed"
        },
        "ip_dst_addr": {
          "type": "ip"
        },
        "ip_dst_port": {
          "type": "integer"
        },
        "ip_src_addr": {
          "type": "ip"
        },
        "ip_src_port": {
          "type": "integer"
        },
        "status_code": {
          "type": "integer"
        },
        "method": {
          "type": "string",
          "index": "not_analyzed"
        },
        "protocol": {
          "type": "string",
          "index": "not_analyzed"
        },
        "request_body_len": {
          "type": "long"
        },
        "uri": {
          "type": "string",
          "index": "not_analyzed",
          "ignore_above": 8191
        },
        "uid": {
          "type": "string",
          "index": "not_analyzed"
        },
        "referrer": {
          "type": "string",
          "index": "not_analyzed"
        },
        "trans_depth": {
          "type": "integer"
        },
        "host": {
          "type": "string",
          "index": "not_analyzed"
        },
        "status_msg": {
          "type": "string",
          "index": "not_analyzed"
        },
        "response_body_len": {
          "type": "long"
        },
        "user_agent": {
          "type": "string"
        },
        "query": {
          "type": "string",
          "index": "not_analyzed"
        },
        "answers": {
          "type": "string"
        },
        "AA": {
          "type": "boolean"
        },
        "TC": {
          "type": "boolean"
        },
        "RA": {
          "type": "boolean"
        },
        "RD": {
          "type": "boolean"
        },
        "rejected": {
          "type": "boolean"
        },
        "qclass_name": {
          "type": "string",
          "index": "not_analyzed"
        },
        "proto": {
          "type": "string",
          "index": "not_analyzed"
        },
        "rcode": {
          "type": "integer"
        },
        "rcode_name": {
          "type": "string",
          "index": "not_analyzed"
        },
        "trans_id": {
          "type": "integer"
        },
        "Z": {
          "type": "integer"
        },
        "qclass": {
          "type": "integer"
        },
        "qtype": {
          "type": "integer"
        },
        "qtype_name": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}