script to extract elastic search mapping from header of bro-logs

You might be able to accomplish the desired end result with a dynamic template in elasticsearch. They can be useful for this sort of thing. Instead of doing a type → type mapping, you’d be applying data type handling rules in ES based on the names of the fields you’re interested in. You can do this with the ‘path_match’ option and patterns like “*.orig_h” – if you’re using/allowing dots in the field names… Attached an example. You can also override the default behavior for built-in data types, create sub fields or configure type to type mappings.


es_index_mapping_template.json (1.93 KB)