mappings.json

{
    "dynamic": "false",
    "properties": {
        "@timestamp": {
            "type": "date"
        },
        "tags": {
            "ignore_above": 1024,
            "type": "keyword",
            "meta": {
                "isArray": "true"
            }
        },
        "message": {
            "norms": false,
            "type": "text"
        },
        "ecs": {
            "properties": {
                "version": {
                    "ignore_above": 1024,
                    "type": "keyword"
                }
            }
        },
        "event": {
            "properties": {
                "action": {
                    "ignore_above": 1024,
                    "type": "keyword"
                },
                "provider": {
                    "ignore_above": 1024,
                    "type": "keyword"
                },
                "start": {
                    "type": "date"
                },
                "duration": {
                    "type": "long"
                },
                "end": {
                    "type": "date"
                }
            }
        },
        "error": {
            "properties": {
                "message": {
                    "norms": false,
                    "type": "text"
                }
            }
        },
        "user": {
            "properties": {
                "name": {
                    "fields": {
                        "text": {
                            "norms": false,
                            "type": "text"
                        }
                    },
                    "ignore_above": 1024,
                    "type": "keyword"
                }
            }
        },
        "kibana": {
            "properties": {
                "server_uuid": {
                    "type": "keyword",
                    "ignore_above": 1024
                },
                "alerting": {
                    "properties": {
                        "instance_id": {
                            "type": "keyword",
                            "ignore_above": 1024
                        }
                    }
                },
                "saved_objects": {
                    "properties": {
                        "namespace": {
                            "type": "keyword",
                            "ignore_above": 1024
                        },
                        "id": {
                            "type": "keyword",
                            "ignore_above": 1024
                        },
                        "type": {
                            "type": "keyword",
                            "ignore_above": 1024
                        }
                    },
                    "type": "nested"
                }
            }
        }
    }
}