So I need quite a few session related fields for my F5 project. Do I place it in my new f5 object or should session deserve it's own tlf (top level field ;) )
"f5": {
"session": {
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"key": {
"ignore_above": 1024,
"type": "keyword"
},
"value": {
"ignore_above": 1024,
"type": "keyword"
},
"bytes_in": {
"type": "long"
},
"bytes_out": {
"type": "long"
},
"client_ip": {
"type": "ip"
},
"deleted_reason": {
"ignore_above": 1024,
"type": "keyword"
},
"listener": {
"ignore_above": 1024,
"type": "keyword"
},
"location": {
"ignore_above": 1024,
"type": "keyword"
},
"vip_ip": {
"type": "ip"
}
}
}
So I need quite a few session related fields for my F5 project. Do I place it in my new f5 object or should session deserve it's own tlf (top level field ;) )
For example: