ecs_template.json

{
  "index_patterns" : ["ecs-*"],
  "priority": 500,
  "composed_of": [
    "ecs_agent",
    "ecs_base",
    "ecs_client",
    "ecs_cloud",
    "ecs_container",
    "ecs_data_stream",
    "ecs_destination",
    "ecs_device",
    "ecs_dll",
    "ecs_dns",
    "ecs_ecs",
    "ecs_email",
    "ecs_error",
    "ecs_event",
    "ecs_faas",
    "ecs_file",
    "ecs_group",
    "ecs_host",
    "ecs_http",
    "ecs_log",
    "ecs_network",
    "ecs_observer",
    "ecs_orchestrator",
    "ecs_organization",
    "ecs_package",
    "ecs_process",
    "ecs_registry",
    "ecs_related",
    "ecs_rule",
    "ecs_server",
    "ecs_service",
    "ecs_source",
    "ecs_threat",
    "ecs_tls",
    "ecs_tracing",
    "ecs_url",
    "ecs_user",
    "ecs_user_agent",
    "ecs_volume",
    "ecs_vulnerability"
  ],
  "template" :{
    "settings" : {
      "index" : {
        "mapping.total_fields.limit" : "3000",
        "mapping.nested_fields.limit" : "250",
        "max_docvalue_fields_search" : "200"
      }
    }
  }
}