Sample elasticsearch index template for nginx logs

nginx-logs-template.json

_template/template_nginx_access_log
{
    "index_patterns" : "*-nginx-access*",
    "order" : 1,
    "settings" : {
        "number_of_shards" : 2,
        "number_of_replicas" : 0,
        "codec" : "best_compression"
    },
    "mappings" : {
        "nginx-access-logs" : {
            "_source" : { "enabled" : true },
            "properties" : {
                "TIME_TAKEN" : {"type" : "half_float"},
                "RESPONSE_SIZE" : {"type" : "long"},
                "RCODE" : {"type" : "integer"},
                "origin_location" : {"type" : "geo_point"},
                "REQUEST_URI" : {
                    "type" : "keyword",
                    "ignore_above": 1000,
                    "fields": {
                        "raw": {
                            "type": "text"
                        }
                    }
                },
                "COUNT" : {
                    "type" : "long"
                },
                "ACTUAL_UA" : {
                    "type" : "keyword",
                    "ignore_above": 1000,
                    "fields": {
                        "raw": {
                            "type": "text"
                        }
                    }
                },
                "@timestamp": {
                            "type": "date",
                            "format": "epoch_millis||yyyy-MM-dd HH:mm:ss||yyyy-MM-dd HH:mm:ss.SSS||dateOptionalTime"
                        }
            },
            "dynamic_templates": [
                {
                    "dates": {
                        "match_mapping_type": "*",
                        "match":   "*_DATE",
                        "mapping": {
                          "type": "date",
                          "format": "yyyy-MM-dd HH:mm:ss||epoch_millis||yyyy-MM-dd HH:mm:ss.SSS||dateOptionalTime"
                        }
                    }
                },
                {
                    "integers": {
                        "match_mapping_type": "long",
                        "mapping": {
                            "type": "long"
                        }
                    }
                },
                {
                    "unindexed_doubles": {
                        "match_mapping_type": "double",
                        "mapping": {
                            "type": "float"
                        }
                    }
                },
                {
                    "strings_as_keywords": {
                        "match_mapping_type": "string",
                        "mapping": {
                            "omit_norms": true,
                            "ignore_above": 1000,
                            "doc_values": true,
                            "type": "keyword"
                        }
                    }
                }
            ] 
        }
    }
}