From 726efb61c2198810d3479f7142e25548832554f9 Mon Sep 17 00:00:00 2001
From: 9S <strrrn@gmail.com>
Date: Thu, 11 Jul 2019 09:41:02 +0200
Subject: [PATCH] template patch for geoip

---
 ...-syslog-dns-index.template_ELK7.x_dev.json | 397 +++++++++++++++---
 1 file changed, 347 insertions(+), 50 deletions(-)

diff --git a/json/logstash-syslog-dns-index.template_ELK7.x_dev.json b/json/logstash-syslog-dns-index.template_ELK7.x_dev.json
index 414335f..fd3bd41 100644
--- a/json/logstash-syslog-dns-index.template_ELK7.x_dev.json
+++ b/json/logstash-syslog-dns-index.template_ELK7.x_dev.json
@@ -5,51 +5,324 @@ PUT /_template/logstash-syslog-dns
   ],
   "mappings": {
     "dynamic": "true",
-    "properties": {
-      "source_host": {
-        "type": "ip"
-      },
-      "logrow": {
-        "type": "integer"
-      },
-      "request_from": {
-        "type": "ip"
-      },
-      "source_port": {
-        "type": "integer"
-      },
-      "ip_request": {
-        "type": "ip"
-      },
-      "ip_response": {
-        "type": "ip"
-      },
-      "dns_forward_to": {
-        "type": "ip",
-        "fields": {
-          "keyword": {
-            "type": "keyword",
-            "ignore_above": 256
+      "properties" : {
+        "@timestamp" : {
+          "type" : "date"
+        },
+        "@version" : {
+          "type" : "keyword"
+        },
+        "agent" : {
+          "properties" : {
+            "ephemeral_id" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "hostname" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "id" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "name" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "type" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "version" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            }
           }
-        }
-      },
-      "tags": {
-        "type": "keyword",
-        "fields": {
-          "keyword": {
-            "type": "keyword",
-            "ignore_above": 256
+        },
+        "blocked_domain" : {
+          "type" : "text",
+          "norms" : false,
+          "fields" : {
+            "keyword" : {
+              "type" : "keyword",
+              "ignore_above" : 256
+            }
           }
-        }
-      },
-      "pid": {
-        "type": "integer"
-      },
-      "pihole": {
-        "type": "ip"
-      },
-      "blocked_domain": {
-        "type" : "text",
+        },
+        "date" : {
+          "type" : "date",
+          "format" : "MMM  d HH:mm:ss||MMM dd HH:mm:ss"
+        },
+        "dns_forward_to" : {
+          "type" : "ip",
+          "fields" : {
+            "keyword" : {
+              "type" : "keyword",
+              "ignore_above" : 256
+            }
+          }
+        },
+        "domain_request" : {
+          "type" : "text",
+          "norms" : false,
+          "fields" : {
+            "keyword" : {
+              "type" : "keyword",
+              "ignore_above" : 256
+            }
+          }
+        },
+        "domain_response" : {
+          "type" : "text",
+          "norms" : false,
+          "fields" : {
+            "keyword" : {
+              "type" : "keyword",
+              "ignore_above" : 256
+            }
+          }
+        },
+        "ecs" : {
+          "properties" : {
+            "version" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            }
+          }
+        },
+        "geoip" : {
+          "dynamic" : "true",
+          "properties" : {
+            "city_name" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "continent_code" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "country_code2" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "country_code3" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "country_name" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "dma_code" : {
+              "type" : "long"
+            },
+            "ip" : {
+              "type" : "ip"
+            },
+            "latitude" : {
+              "type" : "half_float"
+            },
+            "location" : {
+              "type" : "geo_point"
+            },
+            "longitude" : {
+              "type" : "half_float"
+            },
+            "postal_code" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "region_code" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "region_name" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            },
+            "timezone" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            }
+          }
+        },
+        "host" : {
+          "properties" : {
+            "name" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            }
+          }
+        },
+        "input" : {
+          "properties" : {
+            "type" : {
+              "type" : "text",
+              "norms" : false,
+              "fields" : {
+                "keyword" : {
+                  "type" : "keyword",
+                  "ignore_above" : 256
+                }
+              }
+            }
+          }
+        },
+        "ip_request" : {
+          "type" : "ip"
+        },
+        "ip_response" : {
+          "type" : "ip"
+        },
+        "log" : {
+          "properties" : {
+            "file" : {
+              "properties" : {
+                "path" : {
+                  "type" : "text",
+                  "norms" : false,
+                  "fields" : {
+                    "keyword" : {
+                      "type" : "keyword",
+                      "ignore_above" : 256
+                    }
+                  }
+                }
+              }
+            },
+            "offset" : {
+              "type" : "long"
+            }
+          }
+        },
+        "logrow" : {
+          "type" : "integer"
+        },
+        "message" : {
+          "type" : "text",
+          "norms" : false
+        },
+        "pid" : {
+          "type" : "integer"
+        },
+        "pihole" : {
+          "type" : "ip"
+        },
+        "program" : {
+          "type" : "text",
+          "norms" : false,
+          "fields" : {
+            "keyword" : {
+              "type" : "keyword",
+              "ignore_above" : 256
+            }
+          }
+        },
+        "query_type" : {
+          "type" : "text",
           "norms" : false,
           "fields" : {
             "keyword" : {
@@ -57,8 +330,11 @@ PUT /_template/logstash-syslog-dns
               "ignore_above" : 256
             }
           }
-      },
-      "domain_request" : {
+        },
+        "request_from" : {
+          "type" : "ip"
+        },
+        "source_fqdn" : {
           "type" : "text",
           "norms" : false,
           "fields" : {
@@ -68,10 +344,31 @@ PUT /_template/logstash-syslog-dns
             }
           }
         },
-      "date": {
-        "type": "date",
-        "format": "MMM  d HH:mm:ss||MMM dd HH:mm:ss"
+        "source_host" : {
+          "type" : "ip"
+        },
+        "source_port" : {
+          "type" : "integer"
+        },
+        "tags" : {
+          "type" : "keyword",
+          "fields" : {
+            "keyword" : {
+              "type" : "keyword",
+              "ignore_above" : 256
+            }
+          }
+        },
+        "type" : {
+          "type" : "text",
+          "norms" : false,
+          "fields" : {
+            "keyword" : {
+              "type" : "keyword",
+              "ignore_above" : 256
+            }
+          }
+        }
       }
-    }
   }
-}
\ No newline at end of file
+}
-- 
GitLab