fluent-plugin-elasticsearchからApacheログ形式のデータをlogstash形式でElasticsearchに入れた時に設定したテンプレート。 まだ、とりあえず版だけど。

template-logstash.json

{
    "template": "logstash-*",
    "settings" : {
        "number_of_shards" : 1,
        "number_of_replicas" : 0
    },
    "mappings": {
        "_default_": { 
            "_source": { "compress": true },
            "dynamic_templates": [
                {
                    "string_template" : { 
                        "match" : "*",
                        "mapping": { "type": "string", "index": "not_analyzed" },
                        "match_mapping_type" : "string"
                     } 
                 }
             ],
             "properties" : {
               "path" : {
                  "type": "multi_field",
                  "fields" : {
                      "analyzed" : {"type":"string", "index" : "analyzed"},
                      "no_analyzed": {"type":"string", "index" : "not_analyzed"}
                  }
                },
               "agent" : {
                  "type": "multi_field",
                  "fields" : {
                      "analyzed" : {"type":"string", "index" : "analyzed"},
                      "no_analyzed": {"type":"string", "index" : "not_analyzed"}
                  }
                },
               "referer" : {
                  "type": "multi_field",
                  "fields" : {
                      "analyzed" : {"type":"string", "index" : "analyzed"},
                      "no_analyzed": {"type":"string", "index" : "not_analyzed"}
                  }
                },
                "@timestamp" : { "type" : "date", "index" : "not_analyzed" }
            }
        }
    }
}