Elasticsearch template for Logstash, showing doc_values for specific fields and using notation on dynamic fields to declare type.

logstash-template.json

{
    "template": "logstash-*",
    "settings" : {
        "number_of_shards" : 180,
        "number_of_replicas" : 1,
        "index.refresh_interval" : "5s",
        "index.routing.allocation.total_shards_per_node" : 4,
        "index.search.slowlog.threshold.query.warn": "100ms",
        "index.search.slowlog.threshold.fetch.warn": "100ms",
        "index.query.default_field" : "message",
        "analysis" : {
            "filter" : {
                "short_long_words" : {
                    "min" : 3,
                    "max" : 64,
                    "type" : "length"
                },
                "sixtyfour_token_limit" : {
                    "max_token_count": 192,
                    "type": "limit"
                }
            },
            "analyzer" : {
                "logstash" : {
                    "type" : "custom",
                    "tokenizer" : "whitespace",
                    "filter" : [ "short_long_words", "stop", "lowercase", "sixtyfour_token_limit" ]
                }
            }
        }
    },
    "mappings": {
        "_default_": {
            "_all": { "enabled": false },
            "_size": { "enabled": true },
            "dynamic_templates": [
                {
                    "short_template" : {
                        "match" : "s_*",
                        "mapping" : { "type" : "short" }
                    }
                },
                {
                    "int_template" : {
                        "match" : "i_*",
                        "mapping" : { "type" : "long" }
                    }
                },
                {
                    "long_template" : {
                        "match" : "l_*",
                        "mapping" : { "type" : "long" }
                    }
                },
                {
                    "float_template" : {
                        "match" : "f_*",
                        "mapping" : { "type" : "double" }
                    }
                },
                {
                    "double_template" : {
                        "match" : "d_*",
                        "mapping" : { "type" : "double" }
                    }
                },
                {
                    "bool_template" : {
                        "match" : "b_*",
                        "mapping" : { "type" : "boolean" }
                    }
                },
                {
                    "string_template" : {
                        "match" : "*",
                        "match_mapping_type": "string",
                        "mapping": { "type": "string", "index": "not_analyzed" }
                    }
                }
            ],
            "properties" : {
                "message" : { "type" : "string", "index" : "analyzed", "omit_norms": true, "analyzer": "logstash", "fielddata": { "format": "disabled" } },
                "type" : { "type" : "string", "index" : "not_analyzed", "fielddata": { "format": "doc_values" } },
                "file" : { "type" : "string", "index" : "not_analyzed" },
                "host" : { "type" : "string", "index" : "not_analyzed", "fielddata": { "format": "doc_values" } },
                "@timestamp" : { "type" : "date", "index" : "not_analyzed", "fielddata": { "format": "doc_values" } },
                "index_timestamp" : { "type" : "date", "index" : "not_analyzed", "format" : "YYYY-MM-dd HH:mm:ss Z", "fielddata": { "format": "doc_values" } }
            }
        }
    }
}