index-template-mapping.json

{
  "template": "logs-*",
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0,
    "index": {
      "refresh_interval": "5s",
      "cache": { "field.type": "soft" },
      "query": { "default_field": "message" },
      "store": { "compress": { "stored": true, "tv": true } },
      "routing": { "allocation.total_shards_per_node": 1 }
    }
  },
  "mappings": {
    "_default_": {
      "_all": { "enabled": false, "omit_norms": true },
      "_source": { "enabled": true },
      "_ttl": { "enabled": true, "default": "900d" },
      "dynamic_templates": [
        {
          "string_fields": {
            "match": "*",
            "match_mapping_type": "string",
            "mapping": {
              "type": "string", "index": "analyzed", "omit_norms": true,
              "fields": {
                "raw": { "type": "string", "index": "not_analyzed", "ignore_above": 256 }
              }
            }
          }
        }
      ],
      "properties": {
        "@timestamp": { "type": "date", "index": "not_analyzed" },
        "@version": { "type": "string", "index": "not_analyzed" },
        "message": { "type": "string", "index": "analyzed" },
        "severity": { "type": "string", "index": "not_analyzed" },
        "fields": {
          "type": "object",
          "dynamic": true
        }
      }
    }
  }
}