squid日志导入elasticsearch的模板设置|-|{"files":{"squid-elasticsearch.json":{"env":"plain"}},"tag":"bigdata"}

squid-elasticsearch.json

{
  "order": 0,
  "template": "hangout-*",
  "settings": {
    "index": {
      "number_of_shards": "40",
      "codec": "best_compression",
      "refresh_interval": "30s"
    }
  },
  "mappings": {
    "logs": {
      "_all": {
        "enabled": false
      },
      "properties": {
        "referer": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "parent": {
          "index": "no",
          "type": "string",
          "doc_values": true
        },
        "city": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "xforwardedfor": {
          "index": "no",
          "type": "string",
          "doc_values": true
        },
        "isp": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "useragent": {
          "index": "no",
          "type": "string",
          "doc_values": true
        },
        "range": {
          "index": "no",
          "type": "string",
          "doc_values": true
        },
        "sizepackage": {
          "index": "no",
          "type": "string",
          "doc_values": true
        },
        "proxypass": {
          "index": "no",
          "type": "string",
          "doc_values": true
        },
        "province": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "responsesize": {
          "index": "not_analyzed",
          "ignore_malformed": true,
          "type": "long",
          "doc_values": true
        },
        "clientip": {
          "index": "no",
          "type": "string",
          "doc_values": true
        },
        "logdate": {
          "format": "yyyy-MM-dd'T'HH:mm:ss.SSSZZ",
          "index": "not_analyzed",
          "type": "date",
          "doc_values": true
        },
        "host": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "responsetime": {
          "index": "not_analyzed",
          "ignore_malformed": true,
          "type": "long",
          "doc_values": true
        },
        "ext": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "squidstatus": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "method": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "contentsize": {
          "index": "not_analyzed",
          "ignore_malformed": true,
          "type": "long",
          "doc_values": true
        },
        "ip": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "httpcode": {
          "index": "not_analyzed",
          "ignore_malformed": true,
          "type": "long",
          "doc_values": true
        },
        "url": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "contenttype": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "@timestamp": {
          "format": "yyyy-MM-dd'T'HH:mm:ss.SSSZZ",
          "index": "not_analyzed",
          "type": "date",
          "doc_values": true
        },
        "domain": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "httpversion": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "contentlength": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        },
        "lastmodify": {
          "index": "not_analyzed",
          "type": "string",
          "doc_values": true
        }
      }
    }
  },
  "aliases": {}
}