{
  "index_patterns": ["network-events-*"],
  "template": {
    "settings": {
      "index.lifecycle.name": "network-events-ilm"
    },
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "host": {
          "properties": {
            "ip": { "type": "ip" },
            "ips": { "type": "ip" },
            "mac": { "type": "keyword" },
            "macs": { "type": "keyword" },
            "id": { "type": "keyword" },
            "name": { "type": "keyword" },
            "hostname": { "type": "keyword" },
            "hostnames": { "type": "keyword" }
          }
        },
        "ports": {
          "properties": {
            "port": { "type": "integer" },
            "proto": { "type": "keyword" },
            "state": { "type": "keyword" },
            "service": {
              "properties": {
                "name": { "type": "keyword" },
                "product": { "type": "keyword" },
                "version": { "type": "keyword" }
              }
            }
          }
        }
      }
    }
  }
}