{
  "order": 0,
  "template": "cisco-asa*",
  "settings": {
    "index.refresh_interval": "5s",
    "number_of_shards" : 1,
    "number_of_replicas" : 0
  },
  "mappings": {
    "cisco-asa": {
      "dynamic_templates": [
        {
          "notanalyzed": {
            "match": "*",
            "match_mapping_type": "string",
            "mapping": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "@version": {
          "type": "string"
        },
        "action": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "assigned_ip": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "assigned_ipv6": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "cisco-type": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "direction": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "dst_interface": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "dst_ip": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "dst_port": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "err_dst_interface": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "err_dst_ip": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "err_icmp_code": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "err_icmp_type": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "err_protocol": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "err_src_fwuser": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "err_src_interface": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "err_src_ip": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "event-code": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "group": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "hashcode1": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "hashcode2": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "host": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "icmp_code": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "icmp_type": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "interface": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "log_msg": {
          "norms": false,
          "type": "text"
        },
        "orig_dst_ip": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "orig_dst_port ": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "orig_src_ip": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "orig_src_port": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "policy_id": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "protocol": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "reason": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "src_interface": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "src_ip": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "src_port": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "syslog_facility": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "syslog_facility_code": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "syslog_severity": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "syslog_severity_code": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "tags": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "tcp_flags": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "geoip": {
          "type": "object",
          "properties": {
            "area_code": {
              "type": "long"
            },
            "city_name": {
              "ignore_above": 1024,
              "type": "keyword",
              "doc_values": "true"
            },
            "continent_code": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "country_code2": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "country_code3": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "country_name": {
              "ignore_above": 1024,
              "type": "keyword",
              "doc_values": "true"
            },
            "dma_code": {
              "type": "long"
            },
            "ip": {
              "ignore_above": 1024,
              "type": "keyword",
              "doc_values": "true"
            },
            "latitude": {
              "type": "double"
            },
            "longitude": {
              "type": "double"
            },
            "location": {
              "type": "geo_point"
            },
            "geohash": {
              "type": "geo_point"
            },
            "postal_code": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "real_region_name": {
              "ignore_above": 1024,
              "type": "keyword",
              "doc_values": "true"
            },
            "region_name": {
              "ignore_above": 1024,
              "type": "keyword",
              "doc_values": "true"
            },
            "timezone": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        }
        
      }
    }
  }
}