{
  "_meta": {
    "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-email.html",
    "ecs_version": "8.7.0-dev"
  },
  "template": {
    "mappings": {
      "properties": {
        "email": {
          "properties": {
            "attachments": {
              "properties": {
                "file": {
                  "properties": {
                    "extension": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "hash": {
                      "properties": {
                        "md5": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sha1": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sha256": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sha384": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sha512": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "ssdeep": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "tlsh": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "mime_type": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "size": {
                      "type": "long"
                    }
                  }
                }
              },
              "type": "nested"
            },
            "bcc": {
              "properties": {
                "address": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "cc": {
              "properties": {
                "address": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "content_type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "delivery_timestamp": {
              "type": "date"
            },
            "direction": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "from": {
              "properties": {
                "address": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "local_id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "message_id": {
              "type": "wildcard"
            },
            "origination_timestamp": {
              "type": "date"
            },
            "reply_to": {
              "properties": {
                "address": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "sender": {
              "properties": {
                "address": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "subject": {
              "fields": {
                "text": {
                  "type": "match_only_text"
                }
              },
              "ignore_above": 1024,
              "type": "keyword"
            },
            "to": {
              "properties": {
                "address": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "x_mailer": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        }
      }
    }
  }
}
