Lets create a test template that inherit settings from network template ( which has order 0 ):
cat /tmp/network-switch.json
{
"order" : 10,
"index_patterns" : [
"network-tmp*"
],
"settings" : { },
"mappings" : {
"doc" : {
"properties" : {
"client_ip" : {
"type" : "ip"
},
"device_name" : {
"type" : "text"
},
"host": {
"type": "object",
"properties": {
"name": {
"type": "keyword"
}
}
},
"message" : {
"type" : "text"
},
"reason" : {
"type" : "text"
},
"switch_ip" : {
"type" : "ip"
},
"switchport" : {
"type" : "text"
},
"tags" : {
"type" : "text"
},
"username" : {
"type" : "text"
}
}
}
},
"aliases" : { }
}
Lets apply :
curl -s -u admin:password -H 'Content-Type: application/json' -XPUT energylogserver01.local:9200/network-tmp-1?pretty
And check:
curl -s -u admin:password -H 'Content-Type: application/json' -XGET energylogserver01.local:9200/network-tmp-1/_mapping?pretty
{
"network-tmp-1" : {
"mappings" : {
"doc" : {
"properties" : {
"client_ip" : {
"type" : "ip"
},
"device_name" : {
"type" : "text"
},
"host" : {
"properties" : {
"architecture" : {
"type" : "keyword",
"ignore_above" : 1024
},
"id" : {
"type" : "keyword",
"ignore_above" : 1024
},
"ip" : {
"type" : "ip"
},
"mac" : {
"type" : "keyword",
"ignore_above" : 1024
},
"name" : {
"type" : "keyword"
},
"os" : {
"properties" : {
"family" : {
"type" : "keyword",
"ignore_above" : 1024
},
"platform" : {
"type" : "keyword",
"ignore_above" : 1024
},
"version" : {
"type" : "keyword",,
"ignore_above" : 1024
}
}
}
}
},
"message" : {
"type" : "text"
},
"reason" : {
"type" : "text"
},
"switch_ip" : {
"type" : "ip"
},
"switchport" : {
"type" : "text"
},
"tags" : {
"type" : "text"
},
"username" : {
"type" : "text"
}
}
}
}
}
}
This new tamplate network-tmp-1 contaings field types defined in /tmp/network-switch.json.
I hope that helps.
