template.json

{
  "_meta": {
    "description": "Sample composable template that includes all ECS fields",
    "ecs_version": "9.1.0-dev"
  },
  "composed_of": [
    "ecs_9.1.0-dev_base",
    "ecs_9.1.0-dev_agent",
    "ecs_9.1.0-dev_client",
    "ecs_9.1.0-dev_cloud",
    "ecs_9.1.0-dev_container",
    "ecs_9.1.0-dev_data_stream",
    "ecs_9.1.0-dev_destination",
    "ecs_9.1.0-dev_device",
    "ecs_9.1.0-dev_dll",
    "ecs_9.1.0-dev_dns",
    "ecs_9.1.0-dev_ecs",
    "ecs_9.1.0-dev_email",
    "ecs_9.1.0-dev_error",
    "ecs_9.1.0-dev_event",
    "ecs_9.1.0-dev_faas",
    "ecs_9.1.0-dev_file",
    "ecs_9.1.0-dev_group",
    "ecs_9.1.0-dev_host",
    "ecs_9.1.0-dev_http",
    "ecs_9.1.0-dev_log",
    "ecs_9.1.0-dev_network",
    "ecs_9.1.0-dev_observer",
    "ecs_9.1.0-dev_orchestrator",
    "ecs_9.1.0-dev_organization",
    "ecs_9.1.0-dev_package",
    "ecs_9.1.0-dev_process",
    "ecs_9.1.0-dev_registry",
    "ecs_9.1.0-dev_related",
    "ecs_9.1.0-dev_rule",
    "ecs_9.1.0-dev_server",
    "ecs_9.1.0-dev_service",
    "ecs_9.1.0-dev_source",
    "ecs_9.1.0-dev_threat",
    "ecs_9.1.0-dev_tls",
    "ecs_9.1.0-dev_tracing",
    "ecs_9.1.0-dev_url",
    "ecs_9.1.0-dev_user_agent",
    "ecs_9.1.0-dev_user",
    "ecs_9.1.0-dev_volume",
    "ecs_9.1.0-dev_vulnerability"
  ],
  "index_patterns": [
    "try-ecs-*"
  ],
  "priority": 1,
  "template": {
    "mappings": {
      "date_detection": false,
      "dynamic_templates": [
        {
          "strings_as_keyword": {
            "mapping": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "match_mapping_type": "string"
          }
        }
      ]
    },
    "settings": {
      "index": {
        "codec": "best_compression",
        "mapping": {
          "total_fields": {
            "limit": 2000
          }
        }
      }
    }
  }
}