{
  "_meta": {
    "description": "Sample composable template that includes all ECS fields",
    "ecs_version": "8.7.0-dev+exp"
  },
  "composed_of": [
    "ecs_8.7.0-dev-exp_cgroup",
    "ecs_8.7.0-dev-exp_base",
    "ecs_8.7.0-dev-exp_agent",
    "ecs_8.7.0-dev-exp_client",
    "ecs_8.7.0-dev-exp_cloud",
    "ecs_8.7.0-dev-exp_container",
    "ecs_8.7.0-dev-exp_data_stream",
    "ecs_8.7.0-dev-exp_destination",
    "ecs_8.7.0-dev-exp_device",
    "ecs_8.7.0-dev-exp_dll",
    "ecs_8.7.0-dev-exp_dns",
    "ecs_8.7.0-dev-exp_ecs",
    "ecs_8.7.0-dev-exp_email",
    "ecs_8.7.0-dev-exp_error",
    "ecs_8.7.0-dev-exp_event",
    "ecs_8.7.0-dev-exp_faas",
    "ecs_8.7.0-dev-exp_file",
    "ecs_8.7.0-dev-exp_group",
    "ecs_8.7.0-dev-exp_host",
    "ecs_8.7.0-dev-exp_http",
    "ecs_8.7.0-dev-exp_log",
    "ecs_8.7.0-dev-exp_network",
    "ecs_8.7.0-dev-exp_observer",
    "ecs_8.7.0-dev-exp_orchestrator",
    "ecs_8.7.0-dev-exp_organization",
    "ecs_8.7.0-dev-exp_package",
    "ecs_8.7.0-dev-exp_process",
    "ecs_8.7.0-dev-exp_registry",
    "ecs_8.7.0-dev-exp_related",
    "ecs_8.7.0-dev-exp_rule",
    "ecs_8.7.0-dev-exp_server",
    "ecs_8.7.0-dev-exp_service",
    "ecs_8.7.0-dev-exp_source",
    "ecs_8.7.0-dev-exp_threat",
    "ecs_8.7.0-dev-exp_tls",
    "ecs_8.7.0-dev-exp_tracing",
    "ecs_8.7.0-dev-exp_url",
    "ecs_8.7.0-dev-exp_user_agent",
    "ecs_8.7.0-dev-exp_user",
    "ecs_8.7.0-dev-exp_vulnerability"
  ],
  "index_patterns": [
    "try-ecs-*"
  ],
  "priority": 1,
  "template": {
    "mappings": {
      "date_detection": false,
      "dynamic_templates": [
        {
          "strings_as_keyword": {
            "mapping": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "match_mapping_type": "string"
          }
        }
      ]
    },
    "settings": {
      "index": {
        "codec": "best_compression",
        "mapping": {
          "total_fields": {
            "limit": 2000
          }
        }
      }
    }
  }
}
